CVE-2026-53579: Trilium: Note Import to RCE via Book Note
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an attacker-supplied import archive to embed a payload that executes as script. A book note's content is routed through the same rendering path as text notes and injected into the page with jQuery's html method when the note is shown as a grid-view preview card, so a malicious note survives Safe import and runs as soon as the victim opens the containing note. On the desktop client the Electron renderer runs with Node integration enabled, so the injected JavaScript escalates from cross-site scripting to full remote code execution on the victim's machine. This issue is fixed in version 0.104.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Triliumto a version that resolves this vulnerability.Fixed in 0.104.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Trilium versions through 0.103.0 are exposed if they import an attacker-supplied archive containing a malicious book note and then open the note that contains it. Desktop-client users face remote code execution because the Electron renderer has Node integration enabled.
Is the default configuration affected?
Yes. The default-on Safe import filter is affected because it sanitizes text notes but does not sanitize book note content.
What must an attacker do to trigger exploitation?
The attacker must persuade a victim to import a crafted archive. The embedded script executes when the victim opens the containing note and the malicious book note is rendered as a grid-view preview card.
What should be done if patching is not immediately possible?
Do not import untrusted archives, particularly archives that may contain book notes. Treat imported content as potentially malicious until the installation can be upgraded to 0.104.0.