Vendor
logseq
5 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
High 8.7
Arbitrary File Read, Write, Rename, and Delete in Logseq
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or…
-
High 8.7
Shell command injection in Logseq
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` wi…