Logseq vulnerabilities
We track 3 vulnerabilities in Logseq products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
Latest Logseq vulnerabilities
- 7.3 High severity
logseq: Improper Authentication
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from r
- 8.7 High severity
logseq: Improper Neutralization of Special Elements used in an OS Command
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` wit
- 8.7 High severity
logseq: Exposed Dangerous Method or Function
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or