Trilium’s Safe import filter sanitizes HTML only for text notes; it does not process Mind Map notes, which are stored as raw JSON content. An attacker can embed a mindMap node with a dangerouslySetInnerHTML property that the Mind Elixir library writes directly to the page’s innerHTML, creating an uncontrolled cross‑site scripting flaw (CWE‑79) that permits arbitrary JavaScript execution. Because the desktop Electron client runs with Node integration enabled, the injected script gains full access to the underlying operating system, elevating the XSS into remote code execution (CWE‑94).

All releases of TriliumNext’s Trilium application up to and including version 0.103.0 are affected. The vulnerability exists in the import logic shared by the application, but only the desktop Electron client’s renderer provides the privilege escalation that turns XSS into RCE.

The CVSS score of 9.3 indicates critical severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, but the high score and the ability to execute code at the system level keep the risk high. Exploitation requires a user to open a malicious import archive – a scenario that can be delivered via social engineering or local file interaction. Once the archive is imported, the script executes with full desktop privileges, allowing an attacker to run arbitrary code on the victim’s machine.