CVE-2026-91021

Trilium Notes is a cross-platform hierarchical note-taking application. Prior to version 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS. It combines a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or launcher) with a #docName label using ../ path traversal to point at the payload note's API endpoint. The desktop client Electron runs with nodeIntegration enabled, so RCE is triggered once the payload is executed. This vulnerability is fixed in version 0.102.2.

Trilium Notes, a hierarchical note-taking application, has an XSS vulnerability in the #iconClass value, which is inserted without HTML attribute encoding. A stored payload can execute automatically when a victim opens a new tab or uses Ctrl+J, and due to enabled nodeIntegration and disabled contextIsolation in Electron, it can run operating-system commands. The issue is fixed in version 0.103.0.

Trilium Notes version 0.102.1 and prior contain a critical vulnerability allowing unauthenticated remote code execution (RCE). Lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API allows an attacker to execute arbitrary Node.js code on the server by tricking an authenticated user into viewing a malicious SVG attachment.

Trilium Notes versions 0.102.1 and prior, when running in an Electron environment, disables authentication for the Clipper API, allowing unauthenticated attackers on the local network to access API endpoints without password, API token, or CSRF protection. An attacker can scan ports and gain unauthorized access to data, as well as conduct phishing or compromise the local system.

Trilium Notes versions 0.102.1 and prior contain a vulnerability to TCC bypass via prompt spoofing in the Electron configuration. A local attacker can run malicious code under the trusted app's identity using the RunAsNode flag to execute arbitrary system commands, leading to misleading macOS permission prompts and access to protected resources.

Trilium Notes versions up to 0.102.1 are vulnerable to Local File Inclusion (LFI). An authenticated attacker can read arbitrary files from the server's filesystem via the uploadModifiedFileToAttachment function.