CVE-2026-39311: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TriliumNext Trilium
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet's Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch('/') to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2.
AI Analysis
Technical Summary
CVE-2026-39311 affects Trilium Notes versions prior to 0.102.2. The vulnerability is caused by improper neutralization of input during web page generation (CWE-79) and insecure code execution (CWE-94). Trilium serves SVG attachments with the image/svg+xml MIME type without sanitization and disables the Content Security Policy middleware, removing protections against script execution. An attacker can embed malicious scripts in an SVG that runs in the context of the application, extract the CSRF token, and send signed requests to the backend API endpoint /api/script/exec to execute arbitrary Node.js code. This leads to unauthenticated remote code execution on the server when an authenticated user views the malicious SVG. The flaw is due to an insecure-by-design architecture and has been resolved in version 0.102.2.
Potential Impact
An attacker can achieve unauthenticated remote code execution on the Trilium server by exploiting this vulnerability. This compromises the entire server instance, potentially leading to full system compromise. The attack requires tricking an authenticated user into viewing a malicious SVG attachment. The CVSS score is 6.8 (medium severity) with network attack vector, high attack complexity, required privileges, and user interaction. Confidentiality and integrity impacts are low, but availability impact is high.
Mitigation Recommendations
Upgrade Trilium Notes to version 0.102.2 or later, where this vulnerability is fixed. The fix addresses SVG sanitization and re-enables Content Security Policy protections. No other mitigations are specified. Patch status is confirmed fixed in version 0.102.2.
CVE-2026-39311: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TriliumNext Trilium
Description
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet's Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch('/') to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-39311 affects Trilium Notes versions prior to 0.102.2. The vulnerability is caused by improper neutralization of input during web page generation (CWE-79) and insecure code execution (CWE-94). Trilium serves SVG attachments with the image/svg+xml MIME type without sanitization and disables the Content Security Policy middleware, removing protections against script execution. An attacker can embed malicious scripts in an SVG that runs in the context of the application, extract the CSRF token, and send signed requests to the backend API endpoint /api/script/exec to execute arbitrary Node.js code. This leads to unauthenticated remote code execution on the server when an authenticated user views the malicious SVG. The flaw is due to an insecure-by-design architecture and has been resolved in version 0.102.2.
Potential Impact
An attacker can achieve unauthenticated remote code execution on the Trilium server by exploiting this vulnerability. This compromises the entire server instance, potentially leading to full system compromise. The attack requires tricking an authenticated user into viewing a malicious SVG attachment. The CVSS score is 6.8 (medium severity) with network attack vector, high attack complexity, required privileges, and user interaction. Confidentiality and integrity impacts are low, but availability impact is high.
Mitigation Recommendations
Upgrade Trilium Notes to version 0.102.2 or later, where this vulnerability is fixed. The fix addresses SVG sanitization and re-enables Content Security Policy protections. No other mitigations are specified. Patch status is confirmed fixed in version 0.102.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-06T19:31:07.265Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0e0ccfba1db473629e776f
Added to database: 5/20/2026, 7:34:39 PM
Last enriched: 5/20/2026, 8:04:01 PM
Last updated: 5/20/2026, 9:26:29 PM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.