Skip to contentTriliumnext Trilium vulnerabilities
- triliumnext triliumTrilium unauthenticated share-search discloses password-protected and hidden shared notesCVE-2026-774387.5 High
- triliumnext triliumTrilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureCVE-2026-535808.1 High
- triliumnext triliumTrilium: Note Import to RCE via Book NoteCVE-2026-535799.3 Critical
- triliumnext triliumTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtmlCVE-2026-535789.3 Critical
- triliumnext triliumTrilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop clientCVE-2026-489969.3 Critical
- triliumnext triliumTrilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)CVE-2026-477278.6 High
- triliumnext triliumTrilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appCVE-2026-457338.3 High
- triliumnext triliumTrilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)CVE-2026-456689.3 Critical
- triliumnext triliumTrilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG AttachmentsCVE-2026-393116.8 Medium
- triliumnext triliumTrilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) BuildsCVE-2026-393108.6 High
- triliumnext triliumTrilium Notes: macOS TCC Bypass via Prompt SpoofingCVE-2026-393095.5 Medium
- triliumnext triliumTrilium Notes has Local File Inclusion via upload modified file API endpointCVE-2026-355936.8 Medium
- triliumnext triliumTrilium Notes has a Timing Attack Vulnerability in /api/login/syncCVE-2025-68621Public exploit7.4 High
- triliumnext triliumTrilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed RetrievalCVE-2025-535447.5 High