Trilium allows an attacker to place server‑side template code in a note by exploiting a flaw in the Safe Import filter: the shareTemplate relation is not flagged as dangerous and is therefore not stripped or sanitized during import. When the imported note is later rendered publicly, the stored template code is passed to the ejs.render engine in the server’s Node process, enabling the execution of arbitrary JavaScript with full access to require, process, the filesystem, and the network. This results in remote code execution over an unauthenticated connection.

The vulnerability exists in TriliumNext’s Trilium application in all releases before 0.104.0. Users running any unsupported version prior to this fix are exposed.

The CVSS score of 8.6 indicates a high severity that was not recorded in CISA KEV and has no EPSS data available. An attacker can exploit the flaw by creating a malicious import archive and sharing the note. In this scenario, any unauthenticated visitor to the shared link will trigger the template rendering and therefore the code execution. The risk is serious, especially in environments where public sharing is enabled, and the lack of mitigation or awareness measures further increases the likelihood of exploitation.