XSS in Logseq

CVE-2026-47900

Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (3.7th percentile) — read the EPSS interpretation.