CVE-2026-48996

Trilium's default-on 'Safe import' filter neutralizes embedded scripts but does not sanitize or escape note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered via innerHTML, so an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload that survives import. The payload executes when the victim opens the GeoMap that renders the compromised marker, constituting stored cross-site scripting (CWE-79). On Trilium's desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates to full remote code execution on the victim's machine (CWE-94), and CVSS 4.0 rates the issue critical at 9.3. All Trilium deployments running version 0.103.0 or earlier are affected, on both desktop and server clients. No public proof-of-concept is known, exploitation has not been observed in the wild or added to CISA KEV, and EPSS puts 30-day exploitation probability at 0.2%.

What to do: Upgrade to Trilium 0.104.0, which fixes the issue; this applies to both desktop and server deployments. Until upgraded, do not import archives from untrusted sources and avoid opening GeoMap notes whose markers originate from imported data, and review imported note titles for embedded HTML or event-handler payloads. Defenders can check whether imported notes with HTML-bearing titles exist in affected instances to identify potential past compromise.