Trillium Notes
Monthly
Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. CISA SSVC rates exploitation as none and automatable as no, and no public exploit code or KEV listing is present in the supplied intelligence.
Stored cross-site scripting in the share renderer of Trilium Notes v0.103.0 and earlier lets anyone with note-authoring privileges embed arbitrary JavaScript in a webView note via the unescaped #webViewSrc attribute, which then executes in the browser of every user who opens the shared note — including administrators. The flaw requires an authenticated author to create or modify the note and a victim to open the shared link (CVSS 5.4, PR:L/UI:R/S:C), so it is a privilege-escalation and session-hijack vector rather than an unauthenticated remote compromise. CISA SSVC rates exploitation as none and automatable as no, and no public exploit code or KEV listing is present in the supplied intelligence.