CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021 CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021

The Trilium Notes application, version v0.103.0 and earlier, is susceptible to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. An attacker with note-authoring privileges...

EUVD-2026-77678

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021 CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

PT-2026-91293

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021: Improper Neutralization of Input During Web Page Generation

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733

CVE-2026-45733 is a stored XSS in Trilium Notes (prior to 0.103.0) that escalates to remote code execution on the victim's operating system. The #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in quick_search.ts and note_a...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

EUVD-2026-60956

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733: Improper Neutralization of Input During Web Page Generation

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

PT-2026-77141

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quic...

Trilium Notes Safe Import RCE (CVE-2026-45668)

Exploits CVE-2026-45668 in Trilium Notes TriliumNext = 0.102.1: a malicious export ZIP imported with safeImport=true keeps a code-note XSS payload, a docName label with path traversal, and a '' noteId preserved verbatim. Opening the trigger doc loads the payload via jQuery into a nodeIntegration...

Trilium Notes CVE-2026-45668 Safe Import RCE Detect

Detects CVE-2026-45668 in Trilium Notes TriliumNext desktop = 0.102.1: safe import fails to strip docName path traversal and code-note XSS, enabling RCE in the nodeIntegration Electron renderer. Fingerprints /bootstrap for triliumVersion fixed in 0.102.2. !/usr/bin/env python3 -- coding: utf-8 --...