CVE-2026-48996: Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archive to inject script that runs when the map is displayed. Because Safe import neutralizes scripts but never escapes titles, a note whose title contains an HTML event-handler payload survives the import and executes as soon as the victim opens the GeoMap that renders its marker. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Triliumto a version that resolves this vulnerability.Fixed in 0.104.0
Event History
Frequently Asked Questions
Which deployments and versions are affected?
Trilium versions up to and including 0.103.0 are affected. The described remote code execution impact applies to the desktop client, where the Electron renderer has Node integration enabled.
What must an attacker do to trigger exploitation?
An attacker must provide a malicious import archive containing a note title with an HTML event-handler payload and a GeoMap that renders that note as a marker. The payload executes when the victim imports the archive and opens the affected GeoMap view.
Does enabling Safe import prevent this attack?
No. Safe import is enabled by default, but it neutralizes scripts without escaping note titles, allowing a malicious title payload to survive the import.
What should organizations do if they cannot patch immediately?
Do not import untrusted archives, and avoid opening GeoMap views from imported content that may be attacker-controlled. Upgrade to version 0.104.0 when possible.