EUVD-2026-33376Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.
AnalysisAI
Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary code execution by tricking a user into importing a malicious ZIP archive with safe import enabled. The flaw chains a #docName path traversal (CWE-22) with stored XSS, and the Electron renderer's nodeIntegration=true setting elevates the XSS into full host RCE. No public exploit identified at time of analysis, but the vendor advisory describes a complete working chain and the CVSS 4.0 score of 9.3 reflects subsequent-system impact.
Technical ContextAI
Trilium is an open-source hierarchical note-taking application built on Electron, with a desktop client whose renderer process is configured with Node.js integration enabled - meaning any JavaScript executing in the renderer can invoke Node APIs (child_process, fs) and break out of the browser sandbox. The vulnerability sits at the intersection of two flaws: a CWE-22 path-traversal weakness in how the #docName label resolves API endpoints (using ../ sequences to redirect to an attacker-supplied payload note), and an XSS sink where a note of type 'code' with mime 'text/plain' has its raw HTML/JavaScript rendered when reached via a 'doc' or 'launcher' trigger note. The affected product per CPE is cpe:2.3:a:triliumnext:trilium up to 0.102.2.
RemediationAI
Upgrade to Trilium 0.102.2 or later, which is the vendor-released patch confirmed in the GitHub Security Advisory GHSA-9jjc-cccq-f6rh (https://github.com/TriliumNext/Trilium/security/advisories/GHSA-9jjc-cccq-f6rh). Until patched, disable the 'safe import' feature and refuse ZIP imports from untrusted sources - the trade-off is loss of the import workflow for legitimate archives. Operators can further reduce blast radius by running the web/server variant rather than the desktop Electron client, since the RCE escalation depends on nodeIntegration=true in the renderer; this trades convenience and offline use for sandbox confinement. Inspect any recently imported archives for code-type notes containing raw HTML/JavaScript and trigger notes carrying #docName labels with ../ sequences.
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Saf
Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic
Stored XSS-to-RCE chain in Trilium Notes versions 0.102.1 and prior allows a network attacker to execute arbitrary Node.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today