Remote Code Execution in Trilium Notes Application by TriliumNext

CVE-2026-39311

What is CVE-2026-39311?

Trilium Notes, a versatile hierarchical note-taking application, is vulnerable due to a design flaw that allows unauthenticated remote code execution. The issue is caused by the lack of sanitization for SVG files and a disabled Content Security Policy (CSP). Consequently, if an attacker can deceive an authenticated user into viewing a compromised SVG attachment, they can exploit the vulnerability to execute arbitrary Node.js code on the server. This can lead to a complete server compromise, making it imperative for users to update to version 0.102.2, which addresses and resolves this serious security issue.

References