CVE-2026-53579 in Trilium
Summary
by MITRE • 08/27/2026
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
Trilium Notes, a widely used open-source hierarchical note-taking application, contains a critical security vulnerability affecting versions up to and including 0.103.0 that allows for remote code execution through maliciously crafted import archives. The core of this issue lies in the inconsistency within the application's input validation logic, specifically regarding how different note types are processed during data ingestion. While the default Safe Import feature is designed to sanitize HTML content to prevent script injection, it only applies these sanitization rules to text notes. Book notes, which store their content without undergoing any such filtering or sanitization processes, remain vulnerable because they bypass the security controls intended for other content types. This discrepancy creates a significant attack surface where an attacker can embed malicious JavaScript payloads within a book note that will survive the import process intact and unaltered.
The technical flaw manifests when the application renders these unsanitized book notes in specific user interface contexts, particularly when displaying them as grid-view preview cards. In this scenario, the content of the book note is routed through the same rendering pipeline used for text notes but lacks the protective sanitization layer. The raw HTML content from the malicious import archive is directly injected into the page using jQuery's html method. This operation effectively executes any embedded scripts within the context of the user's session. Because the injection occurs during the visual presentation of the note, an attacker does not need to trick a victim into clicking a link or submitting a form; simply opening the containing folder or view that triggers the grid-view preview is sufficient to initiate the payload execution. This represents a classic Stored Cross-Site Scripting vulnerability where the malicious content persists in the application's data store and executes automatically upon access, aligning with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as XSS.
The severity of this vulnerability is significantly amplified by the architecture of the Trilium desktop client, which is built on Electron. In many default configurations for such applications, Node integration is enabled within the renderer process to allow access to local system resources via JavaScript APIs. When a malicious script executes in this environment due to the aforementioned XSS flaw, it does not remain confined to browser-level restrictions. Instead, the attacker gains the ability to execute arbitrary commands on the victim's operating system through Electron's Node.js integration capabilities. This escalation transforms what would otherwise be a standard cross-site scripting issue into a full Remote Code Execution vulnerability. The impact is severe, allowing an adversary to compromise the integrity and confidentiality of the user's local environment, potentially leading to data theft, installation of malware, or complete control over the affected machine.
This specific attack vector aligns with several entries in the MITRE ATT&CK framework, particularly those related to client-side code injection and execution within desktop applications. The exploitation technique leverages CWE-94 Improper Control of Generation of Code (Code Injection) by injecting executable scripts into a trusted application context. Furthermore, it relates to CWE-78 OS Command Injection if the executed JavaScript utilizes Node.js APIs to spawn system processes. The vulnerability highlights the risks associated with enabling powerful runtime features like Node integration in desktop applications without rigorous input validation across all data types and rendering paths.
To mitigate this risk, users of Trilium Notes must upgrade immediately to version 0.104.0 or later, where the developers have addressed these inconsistencies by ensuring that book notes are also subjected to proper HTML sanitization during import operations. Until an update is applied, administrators should exercise extreme caution when importing archives from untrusted sources and consider disabling Node integration in Electron-based clients if feasible within their deployment constraints, although this may impact functionality. Security teams should audit existing note databases for any pre-existing malicious book notes that might have been imported prior to the patching of vulnerable instances. Regular security assessments focusing on input validation consistency across different data types are essential to prevent similar discrepancies from arising in other parts of the application or in future updates.