Critical severity9.6OSV Advisory· Published Oct 9, 2025· Updated Apr 15, 2026

CVE-2025-56683

Description

A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting arbitrary Javascript into a crafted README.md file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Logseq/LogseqOSV2 versions
0.0.1-10, 0.0.1-100, 0.0.1-11, …+ 1 more
- (no CPE)range: 0.0.1-10, 0.0.1-100, 0.0.1-11, …
- (no CPE)range: =0.10.9

Patches

Vulnerability mechanics

References

github.com/logseq/logseq/commit/4cdf49aedd8de073015b6945a529399c3bfa109anvd
github.com/martinkubecka/Attributed-CVEs/blob/main/unresolved-vulnerabilities/logseq_xss_to_rce.mdnvd
martinkubecka.sk/security-advisories/cve-2025-56683/nvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000