Description

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T15:16:54.270Z",
  "pubdate": "2026-08-18T15:16:54.270Z",
  "executiveSummary": "Trilium Notes prior to version 0.103.0 suffers from a Stored Cross-Site Scripting (XSS) vulnerability that allows malicious payloads to execute automatically within the application context.\nThe vulnerability stems from the improper handling of the #iconClass label value, which is returned raw by the getNoteIcon() function and unsafely inserted into HTML class attributes without proper attribute encoding.\nSpecifically, the insecure injection occurs within the codebase files apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts.\nDue to the execution context of the underlying Electron framework—which insecurely enables nodeIntegration and disables contextIsolation—successful exploitation elevates standard XSS into arbitrary operating-system command execution.\nAn attacker capable of injecting a stored payload into a note can achieve full system compromise when a victim interacts with the application by opening a new tab or utilizing the quick navigation shortcut (Ctrl+J).\nThe risk implication is critical, as it bridges a client-side injection vulnerability directly to host-level code execution with the privileges of the victim running the application.",
  "technicalDetails": "The root cause of this vulnerability is a lack of output encoding and sanitization when rendering dynamic data derived from user-controlled note metadata within the client-side user interface.\nThe vulnerable component involves the note icon retrieval mechanism, specifically the getNoteIcon() function, which extracts the #iconClass label value.\nThis raw value is subsequently passed directly into DOM class attributes without escaping within apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts.\nBecause the application is built on top of Electron with dangerously configured security settings—specifically nodeIntegration enabled and contextIsolation disabled—the execution of arbitrary JavaScript within the renderer process is not sandboxed from the underlying Node.js runtime.\nThe attack flow proceeds as follows: an attacker crafts a malicious note containing a specially constructed payload within the #iconClass label value. This payload remains stored persistently within the victim's hierarchical personal knowledge base.\nWhen the victim triggers specific user interface actions, such as opening a new tab or invoking the quick search functionality via the keyboard shortcut Ctrl+J, the application evaluates the stored note metadata.\nThe vulnerable components process the unsanitized #iconClass string and inject it directly into the HTML markup of the active view.\nThe embedded payload executes immediately in the context of the Electron renderer process upon rendering.\nLeveraging the insecure Electron configuration, the executing script gains direct access to Node.js APIs, allowing the attacker to bypass standard web application containment boundaries.\nThis permits the payload to invoke operating-system commands directly on the host machine with the permissions of the user running Trilium Notes, resulting in complete system compromise.\nThis vulnerability affects Trilium Notes versions prior to 0.103.0."
}