CVE-2026-53579: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TriliumNext Trilium

TriliumNext Trilium, an open-source hierarchical note-taking application, contains a vulnerability in versions up to and including 0.103.0 where the default 'Safe import' filter sanitizes HTML only for text notes but excludes the book note type. The book note content is stored without sanitization and rendered as HTML, allowing an attacker to embed malicious scripts in an import archive. When a user views the note in grid-view preview, the malicious script executes via jQuery's html method. On the desktop client, the Electron renderer's Node integration enables escalation from XSS to full remote code execution on the victim's machine. This vulnerability is addressed in version 0.104.0.

An attacker can craft a malicious import archive containing a book note with embedded script that executes when the victim previews the note. This leads to cross-site scripting in the application. On the desktop client, the vulnerability escalates to remote code execution due to Node integration in Electron, potentially allowing full control over the victim's machine. The CVSS 4.0 score is 9.3 (critical), reflecting high impact and exploitability with user interaction required.

Upgrade Trilium to version 0.104.0 or later, where this vulnerability is fixed. No other mitigation or workaround is documented. Patch status is confirmed fixed in 0.104.0.