CyberRota Analysis
AI-GeneratedTrilium Notes versions prior to 0.103.0 are vulnerable due to improper handling of the #iconClass label, allowing attackers to inject and execute arbitrary OS commands through stored payloads when a user interacts with the application. This vulnerability poses a significant risk, as it can lead to remote code execution on the victim's system. Organizations using Trilium Notes should prioritize updating to version 0.103.0 to mitigate this high-severity security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.