trilium vulnerabilities
CVEs whose affected-version data names the trilium package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-77438High· 7.5Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauth…
CVE-2026-53580High· 8.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, all…
CVE-2026-53579Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored with…
CVE-2026-53578Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is sto…
CVE-2026-48996Medium· 6.1Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into …
CVE-2026-47727High· 8.8Trilium is an open-source hierarchical note-taking application
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing a…