EUVD-2026-67163Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft note archive with event-handler title
-
DeliveryDeliver malicious import to victim
-
ExploitVictim imports under Safe import
-
ExecutionOpen GeoMap renders marker innerHTML
-
PersistXSS payload executes
-
ImpactNode integration runs OS commands (desktop RCE)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to (1) import an attacker-supplied note archive, with the default-on "Safe import" filter active (which does not escape note titles), and (2) subsequently open the GeoMap note view that renders the malicious note's marker - that rendering step is what executes the payload. Full remote code execution (beyond browser-scoped XSS) additionally requires the desktop Electron client, where Node integration is enabled; the server/web client suffers only the XSS. Limiting factors: user interaction is mandatory (UI:A) - the archive must be imported and the specific GeoMap view opened - and the vector is local (archive delivery), so there is no unauthenticated network-facing entry point against default configurations. |
| Impact | This is a genuine high-priority issue despite requiring user interaction. The vendor CVSS 4.0 score is 9.3 with vector AV:L/AC:L/AT:N/PR:N/UI:A and high impact across confidentiality, integrity, availability, plus subsequent-system impact (SC:H/SI:H/SA:H) reflecting the Electron sandbox escape to the host OS. The attack is local-vector and needs victim action (importing an untrusted archive and opening the GeoMap), which lowers automatability and mass-exploitation likelihood, so this is realistically a targeted or social-engineering scenario rather than internet-wide worming. No EPSS score was provided in the input, there is no KEV listing, and no public POC was identified, so exploitation probability signals are absent; the severity rests on impact (RCE via Node integration) rather than on ease of remote reach. Because the exploit primitive is a shared/imported note archive, any operator who accepts note exports from others - even a mid-sized team - should treat patching as urgent, but organizations that never import third-party archives face materially lower exposure. Net: patch promptly, especially for desktop-client users. |
| Exploit ScenarioDerived | An attacker crafts a Trilium note-export archive containing a note whose title embeds an HTML event-handler payload (e.g., an onerror/onmouseover handler) and shares it with a victim as a seemingly benign note collection. The victim imports it with the default "Safe import" enabled - which passes because titles are not escaped - and the payload executes as soon as they open the GeoMap that renders the note's marker; on the desktop client, the injected JavaScript uses Electron's Node integration to run arbitrary commands on the machine. No public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0.
RemediationAI
Vendor-released patch: upgrade to Trilium 0.104.0, which HTML-escapes the note title, icon class, color class, and note-id link before rendering GeoMap markers (commit 5245ad70). Until you can upgrade, do not import note archives from untrusted or unverified sources, since the malicious title survives the default "Safe import" filter; if you must review an untrusted import, avoid opening any GeoMap note view, as that is the specific trigger. On desktop, prefer the web/server client for handling untrusted imports because it lacks Node integration and therefore avoids the XSS-to-RCE escalation (trade-off: you lose the desktop client's local integration for that session). Reference the advisory at https://github.com/TriliumNext/Trilium/security/advisories/GHSA-7qfw-c9gj-2xq2 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Trilium is an open-source hierarchical note-taking application (TriliumNext fork). The root cause is CWE-79 (improper neutralization of input during web page generation): the GeoMap collection widget (apps/client/src/widgets/collections/geomap/index.tsx, buildIcon) built marker HTML by string-interpolating the note title, icon class, color class, and note-id link into a template assigned via innerHTML without escaping. The "Safe import" pipeline sanitizes note bodies/scripts but not titles, so a crafted .zip/archive import preserves an event-handler-laden title. On desktop, Trilium runs in an Electron renderer with Node integration enabled, meaning DOM-context JavaScript has access to Node APIs (child_process, fs), which is why an ordinarily browser-scoped XSS becomes arbitrary code execution on the operating system. The fix (commit 5245ad70) wraps each interpolated value in escapeHtml().
Know when Trilium gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Payload is delivered via local file import (AV:L) and needs the victim to import and open the GeoMap (UI:R); no app privileges are required (PR:N); Node-integration escape from renderer to host changes scope (S:C) with full host impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archive to inject script that runs when the map is displayed. Because Safe import neutralizes scripts but never escapes titles, a note whose title contains an HTML event-handler payload survives the import and executes as soon as the victim opens the GeoMap that renders its marker. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Executive ViewAI
TriliumNext Trilium versions through 0.103.0 contain a stored cross-site scripting vulnerability escalating to remote code execution on desktop clients (Electron), allowing attackers to achieve full system compromise when users import malicious note archives. Organizations using Trilium face complete host takeover through a single social-engineered import, with access to local files, credentials, and lateral movement potential.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Saf
Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic
Stored XSS-to-RCE chain in Trilium Notes versions 0.102.1 and prior allows a network attacker to execute arbitrary Node.
Exploit-DB