Trilium EUVD-2026-67224

Exploitation requires that the victim (1) runs a vulnerable Trilium build (<= 0.103.0), (2) imports an attacker-supplied note archive containing a note of type 'book' with a malicious text/html body - the book note type is the exact feature that bypasses the Safe import sanitizer - and (3) opens the containing note so the book note renders as a grid/list-view preview card, which invokes the jQuery .html() sink. Safe import being enabled (the default) does NOT prevent this for book notes. Limiting factors: mandatory user interaction (importing plus opening the note), reliance on social engineering to deliver the archive, and escalation to full RCE specifically requiring the desktop Electron client with Node integration enabled - on the browser/server client impact is confined to XSS within the app's web context.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.3 Critical) reflects a local attack vector gated by active user interaction (the victim must import a crafted archive and open the note) but with maximal confidentiality/integrity/availability impact on both the vulnerable and subsequent system - consistent with XSS-to-RCE via Node integration. Real-world risk hinges on social engineering: an attacker must convince a victim to import a malicious note archive, which limits mass exploitation but is plausible in note-sharing/template workflows. There is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; this is a high-impact but interaction-dependent issue rather than a wormable network flaw. SSVC-style read: exploitation is not automatable (requires user action) while technical impact is total. Treat as a high priority for desktop users who import third-party content.

An attacker crafts a Trilium export archive containing a note declared as type 'book' whose HTML body includes an event-handler payload such as <img src=x onerror="require('child_process').exec('calc')">, then shares it as a helpful template or backup. The victim imports it with default Safe import enabled and opens the containing note; the book note renders as a grid-view preview card, the payload fires via jQuery .html(), and on the desktop client the Node-enabled renderer executes arbitrary OS commands. The fix commit's regression test embeds exactly this payload, but no independent weaponized POC has been published.