6
CVEs
3
Critical
3
High
0
KEV
0
PoC
1
Unpatched C/H
83.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48996 | Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0. | CRITICAL | 9.3 | 0.2% | 47 |
|
| CVE-2026-53578 | Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where the default-on "Safe import" filter sanitizes HTML only for text notes and skips the mindMap note type entirely. An attacker who gets a victim to import a crafted note archive can embed a dangerouslySetInnerHTML payload in the mind map's unsanitized JSON, which Mind Elixir assigns directly to a node's innerHTML when the map is opened; on the Electron desktop client, Node integration turns that XSS into full RCE. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.104.0. | CRITICAL | 9.3 | 0.2% | 47 |
|
| CVE-2026-53579 | Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. No public exploit identified at time of analysis, though the upstream fix commit ships a proof-style test payload, and it is not listed in CISA KEV. | CRITICAL | 9.3 | 0.2% | 47 |
|
| CVE-2026-47727 | Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-53580 | Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all versions prior to 0.104.0. Any authenticated user or valid ETAPI token holder can embed file:// scheme URLs in note img tags to cause the server to read and store arbitrary local files - including sensitive system files accessible to the Trilium process - as retrievable note attachments. The same code path, when directed at an unbounded source such as /dev/zero, triggers uncontrolled memory allocation that crashes the server entirely. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-77438 | Unauthenticated content exfiltration in Trilium up to 0.103.0 is possible through the public share-search endpoint, which applies authorization only to the ancestor note supplied in the request rather than to each result it returns. Any visitor with HTTP access to the instance can query `/share/api/notes` to enumerate titles, tree paths, and share identifiers of notes protected by `shareCredentials` passwords or hidden via `shareHiddenFromTree`, and can use the endpoint as a boolean substring oracle to iteratively reconstruct the full plaintext of password-gated notes. No public exploit has been identified at time of analysis, and the issue is patched in version 0.104.0. | HIGH | 7.5 | 0.2% | 38 |
|