The Electron preload script in Logseq exposes an IPC API that accepts file paths from the renderer process without validation. An attacker who can execute JavaScript in the renderer – for example by exploiting XSS or installing a malicious plugin – can read, overwrite or delete any file that the user’s account can access. This flaw belongs to CWE‑749 and effectively permits unauthorized file access, which could be leveraged to inject code or alter system state, impacting confidentiality, integrity and availability.

Logseq is affected. Version 0.10.15 has been confirmed vulnerable, and the status of other releases remains unknown because no patch has yet been issued by the vendor. Until a fix is released, any installation that still pulls the vulnerable code path remains at risk.

The CVSS score of 8.7 categorises the issue as high severity. The exploitation route requires JavaScript execution inside the renderer, a scenario typically achieved through XSS or compromised plugins, so it is a contextual vector rather than a purely remote one. EPSS is not available and the vulnerability is not in CISA’s KEV catalog, yet the lack of a patch combined with the potential impact makes it a high‑priority concern. Any untrusted plugin or web content that can run JavaScript in the renderer should be treated as a possible vector for escalation.