CVE-2026-45733
HighCVSS 8.3Summary
Trilium Notes, a hierarchical note-taking application, has an XSS vulnerability in the #iconClass value, which is inserted without HTML attribute encoding. A stored payload can execute automatically when a victim opens a new tab or uses Ctrl+J, and due to enabled nodeIntegration and disabled contextIsolation in Electron, it can run operating-system commands. The issue is fixed in version 0.103.0.
Risk Assessment
An attacker can execute arbitrary system commands on the victim's account, potentially leading to full system compromise or data theft.
Recommendation
Upgrade Trilium Notes to version 0.103.0 or later and avoid opening notes from untrusted sources.
Original NVD description (English source)
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.