Logseq Sandbox Escape Vulnerability Allowing Arbitrary JavaScript Execution

A sandbox escape vulnerability has been identified in Logseq, specifically in version 0.10.15 and prior. This flaw allows plugins running in sandboxed iframes to inject arbitrary HTML attributes, including event handlers, into their container elements within the host DOM. The absence of a Content Security Policy (CSP) enables malicious plugins to execute arbitrary JavaScript in the privileged host context, potentially accessing filesystem APIs without authorization.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of JavaScript in the host context, with possible access to sensitive filesystem APIs.