CVE-2026-91021

Trilium Notes versions v0.103.0 and earlier contain a stored XSS vulnerability in the share renderer for webView notes, caused by improper HTML escaping of user-controlled #webViewSrc values. An attacker with note-authoring privileges can inject arbitrary JavaScript that executes in the browser o...