CVE-2026-45733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45733", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T05:51:48.667Z", "datePublished": "2026-08-18T15:13:16.946Z", "dateUpdated": "2026-08-18T15:33:41.704Z"}, "containers": {"cna": {"title": "Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-83", "lang": "en", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg"}, {"name": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009", "tags": ["x_refsource_MISC"], "url": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009"}, {"name": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0"}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"version": "< 0.103.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T15:13:16.946Z"}, "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0."}], "source": {"advisory": "GHSA-h45q-4qc4-8hhg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T15:32:57.681431Z", "id": "CVE-2026-45733", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T15:33:41.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45733", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T15:32:57.681431Z"}}}], "references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T15:33:11.992Z"}}], "cna": {"title": "Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app", "source": {"advisory": "GHSA-h45q-4qc4-8hhg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TriliumNext", "product": "Trilium", "versions": [{"status": "affected", "version": "< 0.103.0"}]}], "references": [{"url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg", "name": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009", "name": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0", "name": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-83", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T15:13:16.946Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45733", "state": "PUBLISHED", "dateUpdated": "2026-08-18T15:33:41.704Z", "dateReserved": "2026-05-13T05:51:48.667Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T15:13:16.946Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Trilium", "vendor": "TriliumNext", "versions": [{"status": "affected", "version": "< 0.103.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0."}, {"lang": "es", "value": "Trilium Notes es una aplicaci\u00f3n multiplataforma de toma de notas jer\u00e1rquica enfocada en la construcci\u00f3n de grandes bases de conocimiento personal. Antes de la versi\u00f3n 0.103.0, el valor de la etiqueta #iconClass es devuelto sin procesar por getNoteIcon() e insertado sin codificaci\u00f3n de atributos HTML en los atributos de clase en apps/cliente/src/widgets/quick_search.ts y apps/cliente/src/services/note_autocomplete.ts, permitiendo que una carga \u00fatil almacenada se ejecute autom\u00e1ticamente cuando una v\u00edctima abre una nueva pesta\u00f1a o usa Ctrl+J y, debido a que Electron habilita nodeIntegration y deshabilita contextIsolation, ejecutar comandos del sistema operativo como la v\u00edctima. Este problema est\u00e1 solucionado en la versi\u00f3n 0.103.0."}], "id": "CVE-2026-45733", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45733", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T15:32:57.681431Z", "version": "2.0.3"}}]}, "published": "2026-08-18T15:16:54.270", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009"}, {"source": "security-advisories@github.com", "url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-83"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.103.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Trilium", "source": "cna", "vendor": "TriliumNext"}, "product": "trilium", "vendor": "triliumnext"}], "created": "2026-08-18T17:00:12.842126+00:00", "updated": "2026-08-18T17:45:06.977336+00:00", "vendors": ["triliumnext", "triliumnext$PRODUCT$trilium"]}