Trilium, an open‑source hierarchical note‑taking application, allows attackers to embed malicious JavaScript in an imported note title. The Safe import filter discards script tags but fails to escape titles, and the GeoMap view places the title directly into innerHTML. When a user opens the map in the desktop client, the renderer runs with Node integration enabled, so the injected script gains full Node privileges and can execute arbitrary code on the system. This elevates a classic cross‑site scripting flaw into a remote code execution vulnerability that can read, modify, or delete files and spawn processes.

The vulnerability affects Trilium releases through version 0.103.0. Versions 0.104.0 and later contain the fix. The issue is limited to the desktop client; the web interface does not expose the same execution path.

The CVSS score of 9.3 signals a high severity attack surface. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must entice a user to import a crafted archive and then view a GPS‑map note containing the malicious title. The attack vector is user‑initiated and local, so exploitation does not require external network access. Once both conditions are met, the lack of title escaping combined with Node integration grants the attacker uncontrolled access to the victim’s machine.