What is the CVSS score of CVE-2026-91021?

CVE-2026-91021 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Trilium CVE-2026-91021

EUVD-2026-77678 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-14 certcc

GHSA-g94c-cfqp-6xq2

XSS Trilium Trillium Notes

5.4

CVSS 3.1 · Vendor: certcc

View

Vulnerability Assessment

Weakness

CWE

CWE-79

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization Output encoding, context-aware escaping

MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. CISA SSVC rates exploitation as none and automatable as no, and no public exploit code or KEV listing is present in the supplied intelligence.

Affected VersionsENISA

Trillium Notes 0 ≤v0.103.0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Trilium gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (certcc) PRIMARY 5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (certcc) · only source for this CVE.

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Sep 14, 2026 - 20:22 NVD

5.4 (MEDIUM)

CVE Published

Sep 14, 2026 - 17:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.

Threat Intelligence Overview

EPSS Score

0.1%

Top 96% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +27

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Trilium

View all

CVE-2025-68621 HIGH This Week POC

7.4 Feb 06

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person

CVE-2022-2290 MEDIUM This Month POC

6.1 Jul 03

Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev

CVE-2023-3067 MEDIUM This Month POC

5.4 Jun 02

Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)

CVE-2022-2365 MEDIUM This Month POC

5.4 Jul 10

Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)

CVE-2026-53579 CRITICAL Act Now

9.3 Aug 27

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including

CVE-2026-53578 CRITICAL Act Now

9.3 Aug 27

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe

CVE-2026-48996 CRITICAL Act Now

9.3 Aug 27

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe

CVE-2026-45668 CRITICAL Act Now

9.3 May 29

Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary

CVE-2026-47727 HIGH This Week

8.6 Aug 27

Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Saf

CVE-2026-39310 HIGH This Week

8.6 May 20

Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat

CVE-2026-53580 HIGH This Week

8.1 Aug 27

Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all

CVE-2026-77438 HIGH This Week

7.5 Aug 27

Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2024-52875 HIGH POC

8.8

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-91021 ADVISORY https://vuldb.com/vuln/403631 REF https://vokecyber.com/research/trilium-share-renderer-stored-xss

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back