EUVD-2026-67224Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload delivered via imported file (AV:L) requiring victim import-and-open (UI:R); no app privileges needed (PR:N); XSS escapes to the OS through Node integration (S:C) with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
AnalysisAI
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim (1) runs a vulnerable Trilium build (<= 0.103.0), (2) imports an attacker-supplied note archive containing a note of type 'book' with a malicious text/html body - the book note type is the exact feature that bypasses the Safe import sanitizer - and (3) opens the containing note so the book note renders as a grid/list-view preview card, which invokes the jQuery .html() sink. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.3 Critical) reflects a local attack vector gated by active user interaction (the victim must import a crafted archive and open the note) but with maximal confidentiality/integrity/availability impact on both the vulnerable and subsequent system - consistent with XSS-to-RCE via Node integration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a Trilium export archive containing a note declared as type 'book' whose HTML body includes an event-handler payload such as <img src=x onerror="require('child_process').exec('calc')">, then shares it as a helpful template or backup. The victim imports it with default Safe import enabled and opens the containing note; the book note renders as a grid-view preview card, the payload fires via jQuery .html(), and on the desktop client the Node-enabled renderer executes arbitrary OS commands. … |
| Remediation | Vendor-released patch: upgrade to Trilium 0.104.0, which extends Safe-import HTML sanitization to cover the 'book' note type in addition to 'text' (see GHSA-h7w4-cjfg-cvj8 and commit abb01f09b3ad7792bd3d42a973730c99a062a808). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running TriliumNext Trilium versions 0.103.0 and earlier; inventory which installations have Node integration enabled in their Electron configuration, as this is a prerequisite for RCE. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)
Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Saf
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic
Stored XSS-to-RCE chain in Trilium Notes versions 0.102.1 and prior allows a network attacker to execute arbitrary Node.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today