CVE-2026-53578

Trilium, an open-source hierarchical note-taking application, fails to sanitize the mindMap note type in its default-on "Safe import" filter, which sanitizes HTML only for text notes; mind map JSON content is stored as-is. A node in an attacker-supplied import archive can carry a dangerouslySetInnerHTML property that the bundled Mind Elixir library assigns directly to the node's innerHTML, so injected script executes as soon as the victim opens the imported mind map. On the desktop client, the Electron renderer runs with Node integration enabled, letting the attacker escalate from stored cross-site scripting to full remote code execution on the victim's machine, while on server deployments the impact is arbitrary script execution in the victim's session. All Trilium users up to and including 0.103.0 who import note archives from untrusted sources are affected. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates the 30-day exploitation probability at roughly 0.2%.

What to do: Upgrade all Trilium desktop and server instances to version 0.104.0 or later. Until upgraded, only import note archives from trusted sources and treat opening imported mind map notes as risky, since desktop users face code execution while server users face script execution in their authenticated session.