TriliumNext vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202613

Newest CVEs

• CVE-2026-77438

  Trilium unauthenticated share-search discloses password-protected and hidden shared notes

  TriliumNext · Trilium

  High7.5
• CVE-2026-53580

  Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

  TriliumNext · Trilium

  High8.1
• CVE-2026-53579

  Trilium: Note Import to RCE via Book Note

  TriliumNext · Trilium

  Critical9.3
• CVE-2026-53578

  Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

  TriliumNext · Trilium

  Critical9.3
• CVE-2026-48996

  Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

  TriliumNext · Trilium

  Critical9.3
• CVE-2026-47727

  Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

  TriliumNext · Trilium

  High8.6
• CVE-2026-45733

  Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

  TriliumNext · Trilium

  High8.3
• CVE-2026-45668

  Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)

  TriliumNext · Trilium

  Critical9.3
• CVE-2026-39311

  Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments

  TriliumNext · Trilium

  Medium6.8
• CVE-2026-39310

  Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds

  TriliumNext · Trilium

  High8.6