EUVD-2026-67238Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No attacker privilege required; UI:R captures mandatory victim import-and-publish steps; S:C reflects attacker code executing in the server Node.js process beyond the share component.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. An unauthenticated request to the shared note then executes the attacker's JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.
AnalysisAI
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three sequential conditions must be satisfied: first, a Trilium user with import privileges must import an attacker-controlled export archive - this is the step the Safe Import filter is supposed to prevent, and the bypass occurs because shareTemplate lacks the isDangerous flag; second, the same user (or any user with access to the note) must publish the imported note by enabling public sharing on it; third, the attacker must be able to send an HTTP request to the Trilium instance's public share endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H accurately reflects the attack profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a Trilium export archive containing a note that holds a shareTemplate relation pointing to a companion EJS code note with a reverse-shell payload (e.g., using Node.js child_process.exec). The archive is distributed through a Trilium community forum or shared workspace as a legitimate-looking template collection. … |
| Remediation | The vendor-released patch is Trilium version 0.104.0, which adds isDangerous: true to the shareTemplate, shareJs, and shareHtml relation definitions in the builtin_attributes configuration, causing the Safe Import filter to strip them from untrusted archives. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Trilium instances running versions prior to 0.104.0 and disable the import functionality or strictly limit imports to pre-approved internal sources only; simultaneously notify all users not to import export archives from external or untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta. Rated medium sev
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Rated medium severity (CVSS 5.4)
Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3. Rated medium severity (CVSS 5.4)
Remote code execution in TriliumNext Trilium Notes desktop client prior to 0.102.2 allows attackers to achieve arbitrary
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, whe
Authentication bypass in Trilium Notes Desktop (Electron build) versions 0.102.1 and earlier allows remote unauthenticat
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all
Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, whic
Stored XSS-to-RCE chain in Trilium Notes versions 0.102.1 and prior allows a network attacker to execute arbitrary Node.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today