Arbitrary HTML Injection Vulnerability in Trilium Note-Taking Application
CVE-2026-53578

9.3CRITICAL

Key Information:

Vendor

Triliumnext

Status
Trilium
Vendor
CVE Published:
27 August 2026

What is CVE-2026-53578?

The Trilium note-taking application has a flaw in its default 'Safe import' filter that fails to sanitize JSON content for mindMap note types. Attackers can exploit this vulnerability to embed malicious payloads within imported mind map nodes. When a victim opens an imported mind map, the payload executes as arbitrary HTML through the dangerouslySetInnerHTML property, leading to potential full remote code execution. This issue was addressed in version 0.104.0, emphasizing the importance of updating to secure versions to protect against such attacks.

Affected Version(s)

Trilium < 0.104.0

References

https://github.com/TriliumNext/Trilium/security/advisorie...
x_refsource_CONFIRM
https://github.com/TriliumNext/Trilium/commit/15da3ff626c...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.