CVE-2026-47727

Trilium Notes, an open-source self-hosted hierarchical note-taking application, fails before version 0.104.0 to treat the shareTemplate relation as dangerous, so its default-on "Safe import" filter does not disable that code-loading relation during import. An attacker who induces a victim to import a crafted archive can plant a server-side share template whose linked EJS code note is later passed raw into ejs.render when the victim publishes the imported note for sharing. Once the note is published, any unauthenticated request to the shared note executes the attacker's JavaScript in the server's Node process with full access to require, process, the filesystem, and the network, yielding remote code execution. Only Trilium deployments running versions prior to 0.104.0 are affected, and the flaw is fixed in 0.104.0. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, with EPSS currently estimating a 0.4% probability of exploitation within 30 days.

What to do: Upgrade Trilium to version 0.104.0 or later. Until upgraded, import note archives only from trusted sources, avoid publishing newly imported notes, and audit existing shared notes for shareTemplate relations pointing to code notes you did not create; restrict public internet exposure of Trilium servers where feasible.