Executive brief
Trilium is an open-source note-taking application that allows users to import notes from archive files. A flaw in the "Safe import" security filter fails to sanitize HTML content in book-type notes, while sanitizing text notes correctly. An attacker can craft a malicious import archive containing a book note with embedded JavaScript that executes when the note is displayed. On the desktop client, this JavaScript runs with full system access and can execute arbitrary commands on the victim's machine.
Technical details
The vulnerability is an HTML injection / cross-site scripting (XSS) that escalates to remote code execution on the desktop client. Root cause: the import sanitization function `processTextNoteContent()` is only called for notes with type "text", but book notes follow the same rendering path through `renderText()` and `content_renderer.getRenderedContent()`, where unsanitized content is injected into the page via jQuery's `.html()` method. Attack vector is local and requires user interaction (importing a malicious archive). On Electron-based desktop clients with `nodeIntegration` enabled, the injected JavaScript can call `require('child_process').exec()` to execute system commands. The vulnerability affects Trilium versions up to 0.103.0 and is fixed in 0.104.0.
Affected products
- TriliumNext Trilium up to and including 0.103.0
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: fixed in version 0.104.0