Executive brief
Trilium is an open-source note-taking application that allows users to organize and view notes hierarchically. The application's "Safe import" feature fails to sanitize note titles before rendering them in GeoMap views, allowing an attacker to inject malicious HTML/JavaScript through a crafted import file. On the desktop client, this code executes with full system privileges, enabling remote code execution on the user's machine.
Technical details
This vulnerability is a stored cross-site scripting (XSS) that escalates to remote code execution (RCE) on the Electron desktop client. The root cause is that the GeoMap widget's buildIcon() function interpolates note titles directly as raw HTML via innerHTML without sanitization, even though the "Safe import" filter is enabled. The attack vector requires user interaction: an attacker must trick the victim into importing a malicious .zip archive containing a GeoMap note with an HTML event-handler payload (e.g., <img onerror="...">) in its title. The XSS fires when the map renders the marker icon, and because the Electron renderer has nodeIntegration enabled, the injected JavaScript can call Node.js APIs like child_process.exec() to achieve full RCE. The vulnerability was patched in version 0.104.0 by properly escaping title values before rendering.
Affected products
- TriliumNext Trilium up to and including 0.103.0
Timeline
- 2026-08-20: disclosed
- 2026-08-27: advisory: CVE-2026-48996 published
- 2026-08-20: patched: Fixed in version 0.104.0