CVE-2026-47727
HighCVSS 8.6Summary
Trilium, prior to version 0.104.0, has a vulnerability in the default-on "Safe import" filter. The filter fails to neutralize the shareTemplate relation because it is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template leading to remote code execution. When the victim publishes the imported note, the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. Fixed in version 0.104.0.
Risk Assessment
The risk includes remote code execution by an unauthenticated attacker after the imported note is published, potentially leading to full server compromise.
Recommendation
It is recommended to upgrade Trilium to version 0.104.0 or later and avoid importing untrusted archives.
Original NVD description (English source)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note's raw bytes into ejs.render, which compiles them in the server's Node process. An unauthenticated request to the shared note then executes the attacker's JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.