The flaw allows a sandboxed plugin running inside an iframe to inject arbitrary HTML attributes, including event handlers, into the container element that sits in the host Document Object Model. With the host’s Content Security Policy disabled, the injected code runs with the full privileges of the host application, which can access filesystem APIs and other privileged functions. This is a typical example of a cross‑site scripting weakness identified as CWE‑79 that can lead to unauthorized data access or modification if a malicious plugin is executed.

The affected product is Logseq Logseq. The vulnerability was demonstrated in version 0.10.15; the status of other versions remains unknown and no patch has been released to address the issue yet.

The CVSS score of 4.6 places the flaw in the moderate range, and no EPSS score is currently available, indicating no known widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a malicious or compromised plugin, which an attacker can supply to a user who enables it. If executed, this path grants JavaScript execution in the privileged context, which could provide broad access to the host’s filesystem and data. While the absence of public exploit evidence suggests limited risk, any environment that allows arbitrary plugin installation poses a moderate to high threat.