CVE-2026-53578: Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied import archive to embed a payload that renders as arbitrary HTML. A mind map node can carry a dangerouslySetInnerHTML property that the Mind Elixir library assigns directly to a node's innerHTML, so a malicious note survives Safe import and executes script as soon as the victim opens the imported mind map. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.104.0
Event History
Frequently Asked Questions
Who is exposed to remote code execution?
Users of the Trilium desktop client who import a malicious archive and then open its included mind map are exposed. The Electron renderer has Node integration enabled, allowing injected JavaScript to execute code on the victim's machine.
Does enabling Safe import prevent exploitation?
No. Safe import is enabled by default, but it sanitizes HTML only for text notes and does not sanitize mindMap note content.
What attacker interaction is required?
An attacker must provide a crafted import archive. The victim must import it and open the malicious mind map for the payload to execute.
What should be done if patching cannot happen immediately?
Do not import archives from untrusted sources, and avoid opening mind maps from previously imported untrusted archives. The issue is fixed in version 0.104.0.