EUVD-2026-77678
GHSA-g94c-cfqp-6xq2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.
AnalysisAI
Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Saf
Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today