Stored XSS Vulnerability in Trilium Notes by TriliumNext
CVE-2026-45733
8.3HIGH
What is CVE-2026-45733?
Trilium Notes, a cross-platform hierarchical note-taking application, contains a vulnerability that allows stored payloads to execute automatically under certain conditions. Specifically, prior to version 0.103.0, the application did not properly encode the #iconClass label value in its output, leading to potential XSS attacks. When a user opens a new tab or utilizes the shortcut Ctrl+J, malicious code could be executed due to the enabled nodeIntegration and disabled contextIsolation in the Electron framework. Users are advised to upgrade to version 0.103.0 or later to mitigate this security risk.
Affected Version(s)
Trilium < 0.103.0