{"id":"CVE-2026-45733","title":"Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases","summary":"Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L","cwe":["CWE-79","CWE-83","CWE-693"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45733","references":[{"url":"https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009","label":"security-advisories@github.com"},{"url":"https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0","label":"security-advisories@github.com"},{"url":"https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg","label":"security-advisories@github.com"},{"url":"https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00386,"epssPercentile":0.32383,"ingestedAt":"2026-09-18T20:51:25.626Z","slug":"CVE-2026-45733","body":"## Overview\n\nTrilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}