Logseq

Risks & limits

Desktop vulnerabilities. CERT Polska published 4 flaws on 2026-06-09, reported by Bartłomiej Dmitruk of striga.ai, with affected versions given as "All through 0.10.15"; the page says only 0.10.15 was tested and other versions' status is unknown because the vendor didn't address the issues. They are: CVE-2026-9279, where an IPC handler joins arguments and the command name into one string and passes it to child_process.spawn with shell: true while the allowlist checks only the command name, score 8.7; CVE-2026-47899, where a preload API doesn't validate paths, allowing arbitrary file reads, writes and deletes, 8.7; CVE-2026-47900, where a plugin's package.json name field is rendered through innerHTML, 4.6; and CVE-2026-47901, where a plugin can inject attributes from its sandboxed iframe onto host elements and, with CSP disabled, run script in the host, 4.6. The CERT page itself lists no scores; these come from the CVE records, scored by CERT-PL under CVSS 4.0, with the records published at 2026-06-09 21:23 (UTC+8).

The preconditions fall into two groups. The first two need an attacker who can already run JavaScript in the renderer, for example through XSS or a malicious plugin; the last two need only a malicious plugin on the user's machine to let its code run in the host, which is exactly the first two's precondition, so the flaws can be chained from a plugin install to running system commands and reading or writing files. On master f8fb34b on 2026-10-25, shell.cljs still runs the joined command with shell: true, with an allowlist of git, pandoc, ag, grep and alda plus user-configured entries, and utils.js still strips Content-Security-Policy and X-Frame-Options from response headers. OG 1.0.0 (2026-04-16) has the same code as 0.10.15: shell.cljs runs the joined command with shell: true, utils.js strips CSP, and Electron is 38.4.0 as well.

Two earlier issues. GitHub security advisory GHSA-92h5-2358-7xjv (2025-08-18, critical, CVSS 4.0 score 9.3) is titled "Remote Code Execution in Logseq Desktop <= 0.10.13"; an outdated pdfjs-dist (CVE-2024-4367) combined with the git exec interface meant that opening a malicious PDF was enough. The advisory's patched-version field is empty, and the 0.10.14 release notes say pdf.js was bumped to 4.2.67. CVE-2025-56683 is an XSS in 0.10.9's plugin marketplace page, triggered through a malicious README; the CVSS 3.1 score of 9.6 listed on NVD comes from CISA-ADP, NVD has not scored it, and the record's status is Deferred; the master fix, commit 4cdf49a (2025-04-25), isn't in the 0.10.15 tag's history, and 2.0.1 includes it.

Bind addresses. The desktop HTTP API server binds 127.0.0.1:12315 by default and doesn't start automatically; if :server/tokens has never been set, the server doesn't check tokens and any local process can call it, and once tokens are set a missing or wrong token gets a 401. Host and port are both configurable. The self-hosted sync service's Node adapter (added 2026-01-30) calls listen with a port and no host, so Node listens on every interface; the default port is 8080 in code, while the README example and start script use 8787; auth relies on Cognito JWTs, and the admin token DB_SYNC_ADMIN_TOKEN is optional.

What the code shows. There is no licence-key or activation check. Non-dev builds initialise PostHog usage analytics and Sentry error reporting by default; the PostHog config turns off autocapture and session recording and masks page text. The "Send usage data and diagnostics to Logseq" setting can switch this off, with the description "Logseq will never collect your local graph database or sell your data." Once it is off, PostHog stops reporting immediately, while Sentry stops initialising only from the next app launch.

What the privacy policy and licence say. The privacy policy lists the technical data the app collects automatically as device information, operating system, platform and release version, with processors including AWS, Sentry and PostHog; New York law applies; the policy says personal information isn't sold. On the licence side, AGPL-3.0 requires publishing the source when a modified version is offered to users over a network, whether or not it is charged for.

Stability. Every tagged release is still marked beta. OG is promised maintenance, but its repo was last pushed on 2026-05-28, before CERT's disclosure date, with no commits addressing those flaws since. The README still says Android is "coming soon", although Releases already ship an Android apk.