Logseq exposes an insecure inter‑process communication (IPC) interface that allows the renderer process to run shell commands. The handler restricts the command name to a whitelist (git, pandoc, grep), but it concatenates unsanitized argument strings and then passes them to child_process.spawn with shell:true, so shell metacharacters can bypass the allow list. An attacker who can execute JavaScript in the renderer, such as through a cross‑site scripting vector or a malicious plugin, can run arbitrary shell commands with the permissions of the Logseq process, achieving remote code execution on the host machine.

The vulnerability has been confirmed only in Logseq version 0.10.15. It is unclear whether earlier or later releases are affected. No other vendor or product is reported to be impacted.

The CVSS base score is 8.7, indicating high severity. Because the attack requires JavaScript execution inside Logseq, the likelihood of exploitation depends on the presence of XSS flaws or exposed plugin mechanisms; without such a vector the risk is lower, but when present it can lead to full system compromise. The EPSS score is unavailable, so the probability of exploitation in the wild is uncertain. The vulnerability is not listed in the CISA KEV catalog.