Trilium EUVD-2026-67223

Exploitation requires the victim to import an attacker-supplied note archive and then open the malicious mindMap note - user interaction is mandatory (UI:A) and the vector is local file delivery (AV:L), not remote unauthenticated network access. The specific prerequisite is a note of type mindMap carrying a dangerouslySetInnerHTML property in its JSON, which the default-on Safe Import filter does not sanitize (it sanitizes only type === "text" notes) in versions up to and including 0.103.0. Escalation from XSS to full remote code execution is limited to the desktop Electron client, where Node integration is enabled in the renderer; on the server/web client the impact is confined to stored XSS. Limiting factors: the attacker cannot trigger this without the victim actively importing the file and opening the map, and patched builds (0.104.0+) neutralize the payload.

The vendor CVSS 4.0 score of 9.3 (Critical) reflects high confidentiality, integrity, and availability impact with a scope change, but the vector's realistic gating factors matter: AV:L and UI:A mean the attacker cannot reach a victim over the network unprompted - the malicious archive must be delivered and the victim must actively import it and then open the specific mind map note. There is no CISA KEV listing and no public proof-of-concept beyond the vendor's own regression test, so this is not evidence of active or widespread exploitation; the signal is a confirmed, high-impact bug rather than an observed campaign. That said, the RCE-on-open behavior on desktop, the near-zero complexity once the file is opened, and the social-engineering ease of "here's a note pack to import" make patching genuinely urgent for anyone running the Electron desktop client. Any operator or self-hosting team that lets users exchange import archives should treat this as high priority and upgrade promptly rather than relying on user caution.

An attacker crafts a Trilium export/import archive containing a mindMap note whose JSON includes a dangerouslySetInnerHTML value such as an img tag with an onerror handler calling require('child_process').exec. They send it to a victim as a shared "note pack," and because Safe Import skips mindMap notes the payload is stored intact; the moment the victim opens that mind map, Mind Elixir writes the markup to innerHTML and, on the Electron desktop client, the script runs with Node privileges to execute arbitrary commands. No public exploit is identified, but the vendor's regression test demonstrates exactly this vector.