VendorsTrilium Notestriliumany version

Vulnerabilities

Trilium Notes Trilium any version

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

8CVEs

Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

Published 2026-08-27 · Analyzed

9.3EPSS 0.003

Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml

Published 2026-08-27 · Analyzed

9.3EPSS 0.003

Trilium: Note Import to RCE via Book Note

Published 2026-08-27 · Analyzed

9.3EPSS 0.003

Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)

Published 2026-08-27 · Analyzed

8.8EPSS 0.005

Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Published 2026-08-27 · Analyzed

8.1EPSS 0.005

Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Published 2026-08-27 · Analyzed

7.5EPSS 0.004

Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

Published 2026-02-06 · Analyzed

7.4EPSS 0.006

Cross-site Scripting (XSS) - Reflected in zadam/trilium

Published 2022-07-03 · Modified

6.4EPSS 0.029