Trilium Notes before version 0.102.2 is vulnerable to a path traversal (CWE-22) combined with cross-site scripting (CWE-79) that allows remote code execution. The attack involves importing a malicious ZIP archive where a trigger note uses a #docName label with ../ path traversal to reference a payload note containing executable HTML/JS code. The Electron desktop client’s nodeIntegration feature enables execution of this payload, resulting in RCE. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No known exploits in the wild have been reported. The issue is resolved in version 0.102.2.

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the victim's system running the vulnerable Trilium Notes desktop client. This can lead to full compromise of the user's environment where the application is installed. The vulnerability leverages path traversal to bypass directory restrictions and XSS to execute malicious scripts in the context of the Electron renderer with nodeIntegration enabled.

Upgrade Trilium Notes to version 0.102.2 or later, where this vulnerability is fixed. Since this is a desktop application and not a cloud service, users must manually apply the update to remediate the issue. Patch status is confirmed by the vendor advisory stating the fix is included in version 0.102.2.