CVE-2025-68621

CVE-2025-68621 — Trilium Notes Timing Attack on /api/login/sync Severity: HIGH CVSS 7.4 Affected Software: TriliumNext/Trilium 0.101.0 Vulnerability Type: CWE-208 – Observable Timing Discrepancy Fixed In: Trilium 0.101.0 PR 8129 Published: 2026-02-06 | Reserved: 2025-12-19 Table of Contents 1. My...

CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

EUVD-2026-77678

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021 CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021

The Trilium Notes application, version v0.103.0 and earlier, is susceptible to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. An attacker with note-authoring privileges...

CVE-2026-91021 CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

PT-2026-91293

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91021: Improper Neutralization of Input During Web Page Generation

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

EUVD-2026-60956

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733

CVE-2026-45733 is a stored XSS in Trilium Notes (prior to 0.103.0) that escalates to remote code execution on the victim's operating system. The #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in quick_search.ts and note_a...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

PT-2026-77141

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quic...

CVE-2026-45733: Improper Neutralization of Input During Web Page Generation

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-35593

Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...

CVE-2026-45668

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via docName path traversal and XSS by combining a payload note type: code, mime:...