Trilium Notes, a hierarchical note-taking application, suffers from a path traversal vulnerability (CWE-22) combined with cross-site scripting (CWE-79) in versions before 0.102.2. When importing a malicious ZIP archive with safe import enabled, an attacker can craft a #docName label that uses '../' path traversal to point to a payload note containing raw HTML/JavaScript code. The Electron desktop client runs with nodeIntegration enabled, allowing this payload to execute with elevated privileges, resulting in remote code execution. The vulnerability is addressed in Trilium version 0.102.2.

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the victim's machine running the vulnerable Trilium Notes desktop client. This is due to the combination of path traversal enabling access to malicious payload notes and the Electron renderer's nodeIntegration feature executing the payload. The impact is critical, potentially allowing full system compromise.

This vulnerability is fixed in Trilium Notes version 0.102.2. Users should upgrade to version 0.102.2 or later to remediate this issue. No additional mitigation guidance is provided or required beyond applying the official fix.