CVE-2026-91021 Overview
CVE-2026-91021 is a stored cross-site scripting (XSS) vulnerability in Trilium Notes, affecting version v0.103.0 and earlier. The flaw resides in the share renderer for webView notes and stems from improper HTML escaping of user-controlled #webViewSrc values. Authenticated users with note-authoring privileges can inject arbitrary JavaScript that executes in the browser of any user who opens the shared note, including administrators. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers with note-authoring rights can execute arbitrary JavaScript in the browsers of note viewers, enabling session theft, credential harvesting, and privilege escalation against administrators.
Affected Products
- Trilium Notes v0.103.0
- Trilium Notes releases prior to v0.103.0
- Trilium Notes share renderer component for webView notes
Discovery Timeline
- 2026-09-14 - CVE-2026-91021 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91021
Vulnerability Analysis
The vulnerability exists in the share renderer that produces publicly viewable HTML for webView notes in Trilium Notes. When a note author sets the #webViewSrc attribute on a note, the renderer inserts that value into the rendered output without proper HTML escaping. Because #webViewSrc is a user-controlled attribute, an attacker can supply values containing HTML or JavaScript that the renderer emits verbatim into the DOM.
Exploitation requires an authenticated user with permission to author notes and requires a victim to open the shared note. When the victim loads the page, the injected script executes under the origin of the Trilium share site with the victim's browser context. This produces a scope change from the attacker's authoring context to the viewer's session, which is why the impact extends to administrators who preview shared content.
Root Cause
The root cause is missing output encoding on the #webViewSrc attribute inside the share renderer. The renderer treats the attribute value as safe markup rather than untrusted user input. HTML metacharacters and script payloads pass through to the rendered document without neutralization, satisfying the conditions for stored XSS under CWE-79.
Attack Vector
The attack path requires network access to a Trilium instance and low-privilege credentials that permit note creation or editing. The attacker sets a malicious #webViewSrc value on a note and shares it. When any user opens the shared link, the injected payload executes in that user's browser session, enabling actions such as cookie theft, forced requests to authenticated endpoints, and DOM manipulation. Because the payload is stored server-side, every viewer is affected until the note is removed or sanitized.
Refer to the Voke Cyber Research Analysis for the technical write-up of the injection path.
Detection Methods for CVE-2026-91021
Indicators of Compromise
- Notes containing #webViewSrc values with HTML tags, <script> elements, event handlers such as onerror or onload, or javascript: URIs.
- Outbound requests from viewer browsers to unfamiliar domains shortly after loading a shared Trilium note.
- Unexpected authenticated actions performed under administrator sessions that recently viewed shared notes.
Detection Strategies
- Audit the Trilium database for notes of type webView and inspect the #webViewSrc attribute values for suspicious markup or scripting constructs.
- Deploy Content Security Policy (CSP) violation reporting on the share host to surface inline script execution attempts.
- Correlate web server access logs for share endpoints with subsequent anomalous authenticated API calls from the same client IP.
Monitoring Recommendations
- Alert on new or modified webView notes authored by low-privilege accounts, especially when they are subsequently shared.
- Monitor administrator browser sessions for unusual DOM-initiated requests originating from Trilium share pages.
- Track share-page view events and pair them with identity telemetry to detect post-view session anomalies.
How to Mitigate CVE-2026-91021
Immediate Actions Required
- Upgrade Trilium Notes to a release later than v0.103.0 that addresses the share renderer escaping defect.
- Audit existing webView notes for malicious #webViewSrc values and remove or sanitize any offending entries.
- Restrict note-authoring privileges to trusted accounts and review recent grants of the authoring role.
Patch Information
The vendor advisory referenced in the Voke Cyber Research Analysis documents the affected component. Administrators should apply the fixed release published after v0.103.0 and validate that the share renderer HTML-escapes #webViewSrc values before deploying to production.
Workarounds
- Disable public sharing of webView notes until the patched version is deployed.
- Place the Trilium share host behind an authenticated proxy so that only trusted viewers can load shared content.
- Enforce a strict Content Security Policy that blocks inline script execution and restricts script sources on the share domain.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
