CVE-2026-47900

CVE-2026-47900

Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the…

Vulnerability class: XSS (Cross-Site Scripting)

Weakness classification (CWE)

References