CVE-2026-91021: XSS
Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trilium Notesto a version that resolves this vulnerability.Fixed in v0.103.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability and who is at risk?
An attacker needs note-authoring privileges to place a malicious #webViewSrc value in a note. Any user who opens the affected shared note can have arbitrary JavaScript execute in their browser, including administrators.
Are older Trilium Notes deployments affected?
The issue affects Trilium Notes v0.103.0 and earlier. The provided information does not identify a fixed version or any configuration-based exception.
How can I determine whether an instance may be exposed?
Review whether users with note-authoring privileges can create or modify shared webView notes and control their #webViewSrc values. Notes containing attacker-controlled HTML in that value may execute script when opened by other users.