Executive brief
Trilium Notes, a hierarchical note-taking application, contains a security flaw that allows an attacker to take complete control of the server hosting the application. By tricking a user into viewing a specially crafted image file (SVG), an attacker can bypass security protections to execute malicious commands. This could lead to the theft of all private notes, data deletion, or the use of the server for further attacks.
Technical details
Trilium Notes (up to v0.102.1) is vulnerable to a multi-stage attack leading to Remote Code Execution. The application serves SVG attachments with the 'image/svg+xml' MIME type without sanitization and explicitly disables Helmet's Content Security Policy (CSP) middleware. This allows an attacker to upload a malicious SVG containing JavaScript. When an authenticated user views the SVG, the script executes under the Same-Origin Policy (SOP), allowing it to fetch the user's CSRF token from the document body. The script then uses this token to make authorized requests to the '/api/script/exec' endpoint, executing arbitrary Node.js code on the server. The issue is fixed in version 0.102.2 by improving SVG handling and content validation.
Affected products
- TriliumNext Trilium Notes <= 0.102.1
Timeline
- 2026-04-05: patched: Version 0.102.2 released with security fixes.
- 2026-05-11: advisory: GitHub Security Advisory GHSA-p837-cxw3-m964 published.
- 2026-05-20: disclosed: CVE-2026-39311 published to NVD.