Logseq IPC Command Injection Vulnerability Allowing Remote Code Execution

A vulnerability in Logseq versions through 0.10.15 allows for arbitrary shell command execution via an inter-process communication (IPC) handler. The renderer process can execute commands with the Logseq process's privileges, leading to remote code execution on the host. This issue arises because, although an allowlist restricts command names to certain utilities like git and grep, the argument strings can include shell metacharacters that bypass this restriction. An attacker with JavaScript execution capabilities in the renderer, such as through cross-site scripting (XSS) or a malicious plugin, can exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary shell command execution on the host system, with the same privileges as the Logseq process.