Trilium Notes allows a note's #iconClass label to be stored directly and later rendered without sanitization. This stored payload can inject arbitrary HTML into class attributes. (CWE‑79: Stored Cross‑Site Scripting) When a user opens a new search tab or presses Ctrl+J, the application automatically executes the payload. Because the Electron framework is configured with nodeIntegration enabled and contextIsolation disabled, the JavaScript code can invoke Node APIs and launch operating‑system commands under the user’s account.

This problem affects TriliumNext:Trilium before version 0.103.0. Users running Trilium 0.102.x or earlier are susceptible. The fixed version 0.103.0 and later are not impacted.

The CVSS score is 8.3, indicating a high severity. EPSS data is unavailable, so the exact exploitation probability is unknown, but the flaw can be triggered by any user who opens a note containing a malicious icon class. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires the victim to have the application installed and to open a note, the attack vector is local or remote if notes are shared, and the attacker can achieve full code execution on the victim’s machine.