CVE-2026-45733: Trilium Notes RCE Vulnerability

CVE-2026-45733 Overview

CVE-2026-45733 is a stored cross-site scripting (XSS) vulnerability in Trilium Notes, a cross-platform hierarchical note-taking application. The flaw exists in versions prior to 0.103.0, where the #iconClass label value returned by getNoteIcon() is inserted into HTML class attributes without encoding. An attacker with note-creation privileges can plant a payload that executes when a victim opens a new tab or presses Ctrl+J. Because the Electron shell enables nodeIntegration and disables contextIsolation, the injected script escalates directly to operating-system command execution as the victim user [CWE-79].

Critical Impact
A stored XSS payload in a note's icon class label achieves arbitrary OS command execution on the victim's machine through Electron's nodeIntegration context.

Affected Products

Trilium Notes versions prior to 0.103.0
TriliumNext desktop (Electron) client
TriliumNext web client (quick_search.ts, note_autocomplete.ts)

Discovery Timeline

2026-08-18 - CVE-2026-45733 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45733

Vulnerability Analysis

The vulnerability arises in two client-side files: apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts. Both files render note icons by concatenating attacker-controlled string data directly into a class attribute of a <span> element. Because getNoteIcon() returns the raw #iconClass label value, an attacker can break out of the attribute context using a crafted payload containing quotes and HTML markup.

Once injected, the payload executes in the Trilium client whenever the victim triggers the quick-search widget (Ctrl+J) or opens a new tab that invokes note autocomplete. In the Electron desktop build, the renderer process has full Node.js access, so the injected JavaScript can invoke require('child_process').exec() and run OS commands under the victim's user context.

Root Cause

The root cause is missing HTML attribute encoding on user-controlled label data. The client concatenated result.icon into markup without passing it through escapeHtml(). Combined with an Electron configuration that enables nodeIntegration and disables contextIsolation, a client-side injection primitive collapses into remote code execution.

Attack Vector

An authenticated attacker sets the #iconClass label on a note (for example, in a shared or synchronized workspace) to a value that closes the class attribute and injects an event handler such as onerror or onload. When another user opens the quick-search UI or the note autocomplete dropdown, the browser parses the malicious markup and fires the attacker's script, which then spawns processes on the host.

typescript

// Patch: apps/client/src/widgets/quick_search.ts
// Build the display HTML with content snippet below the title
let itemHtml = `<div class="quick-search-item">
    <div class="quick-search-item-header">
-       <span class="quick-search-item-icon ${result.icon}"></span>
+       <span class="quick-search-item-icon ${utils.escapeHtml(result.icon)}"></span>
        <span class="search-result-title">${result.highlightedNotePathTitle}</span>
    </div>`;

Source: GitHub Commit c0693944

typescript

// Patch: apps/client/src/services/note_autocomplete.ts
-import server from "./server.js";
+import type { MentionFeedObjectItem } from "@triliumnext/ckeditor5";
+
 import appContext from "../components/app_context.js";
+import commandRegistry from "./command_registry.js";
 import froca from "./froca.js";
 import { t } from "./i18n.js";
+import noteCreateService from "./note_create.js";
+import server from "./server.js";
+import { escapeHtml } from "./utils.js";

Source: GitHub Commit c0693944

Detection Methods for CVE-2026-45733

Indicators of Compromise

Notes containing #iconClass label values with HTML metacharacters such as ", <, >, or event handler substrings like onerror= or onload=.
Trilium desktop processes spawning unexpected child processes (for example, cmd.exe, powershell.exe, /bin/sh) shortly after user interaction with search UI.
Outbound network connections from the Trilium Electron process to attacker-controlled infrastructure.

Detection Strategies

Audit the Trilium database (document.db) for notes whose iconClass attribute value contains characters outside the expected bx bx-* icon namespace.
Monitor Electron renderer process behavior for child_process invocations and file-system writes outside the Trilium data directory.
Review server logs for API calls that set or modify iconClass attributes originating from low-trust accounts.

Monitoring Recommendations

Enable endpoint process telemetry for the Trilium binary and alert on process trees where Trilium spawns shells or scripting engines.
Track version strings of deployed Trilium clients and flag any instance below 0.103.0.
Correlate synchronized note changes with subsequent unusual endpoint activity on collaborating users' hosts.

How to Mitigate CVE-2026-45733

Immediate Actions Required

Upgrade all Trilium Notes clients and server instances to version 0.103.0 or later.
Inventory existing notes and remove or sanitize any #iconClass label whose value is not a well-formed icon class token.
Revoke and re-issue credentials for users whose accounts show evidence of malicious note edits.

Patch Information

The fix landed in commit c06939448bcc2879fc3c4d328ff7dc63ed6b5009 and shipped in Trilium release v0.103.0. The patch routes result.icon and related icon class values through escapeHtml() before interpolation into the class attribute. See the GitHub Security Advisory GHSA-h45q-4qc4-8hhg for full disclosure details.

Workarounds

Until patching is complete, restrict note creation and editing to trusted accounts only.
Avoid using the quick-search widget (Ctrl+J) and note autocomplete on shared or synchronized instances.
Where feasible, run Trilium in the web client behind a browser sandbox rather than the Electron desktop build to eliminate the Node.js execution primitive.

bash

# Upgrade Trilium via Docker to the patched release
docker pull triliumnext/trilium:0.103.0
docker stop trilium && docker rm trilium
docker run -d --name trilium \
    -p 8080:8080 \
    -v ~/trilium-data:/home/node/trilium-data \
    triliumnext/trilium:0.103.0