RCE in Logseq

CVE-2026-9279

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `chi…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.003 (19.0th percentile) — read the EPSS interpretation.