CVE-2026-47901

CVE-2026-47901

Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Due to a disabled Content Security Policy…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (3.7th percentile) — read the EPSS interpretation.

Weakness classification (CWE)

References