Safe import in Trilium sanitizes only text notes while book notes are stored without filtering and later rendered as HTML via jQuery’s html method. This allows an attacker to create a crafted import archive containing JavaScript that will execute when the victim opens the containing note. The malicious script runs inside the Electron renderer where Node integration is active, elevating the attack from a cross‑site scripting flaw to full remote code execution on the host machine.

TriliumNext Trilium versions up to and including 0.103.0 are vulnerable; the issue is fixed in version 0.104.0.

The CVSS score of 9.3 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires the victim to open a maliciously crafted import file containing a book note with embedded JavaScript. Once opened, the payload runs with user privileges in the Electron renderer, providing the attacker full control of the victim’s machine.