Trilium Notes serves SVG attachments without sanitization and disables the Helmet Content Security Policy, allowing arbitrary JavaScript to run inside the browser. The embedded script can read the page’s CSRF token and then send a signed request to the internal /api/script/exec endpoint, which runs Node.js code on the server. Because the exploit only needs a shared SVG to be opened by a user who is already authenticated to the application, an attacker can trick such a user into viewing the attachment and thereby compromise the entire server instance. The core weakness is a classic cross‑site scripting flaw coupled with an exposed code execution API, resulting in remote code execution. The CVE lists CWE‑79 and CWE‑94.

Trilium Notes version 0.102.1 and all earlier releases are affected. The vulnerability has been resolved in version 0.102.2 and later. Any installation of the application that has not been updated to 0.102.2 is vulnerable.

The CVSS base score of 6.8 indicates a moderate severity, and the EPSS score is currently not available. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack path requires an attacker to deliver a malicious SVG to an authenticated user who opens it; similarly, an attacker can host the SVG remotely and persuade a user to open it via a share link. Once executed, the attacker can obtain the CSRF token and invoke the internal script execution API, achieving full server compromise. The pair of weaknesses—lack of sanitization and public execution endpoint—make this a high‑impact flaw for any exposed instance.