CVE-2026-39311
Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments
Description
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet's Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch('/') to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2.
INFO
Published Date :
May 20, 2026, 8:16 p.m.
Last Modified :
July 23, 2026, 12:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-39311
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update Trilium Notes to version 0.102.2.
- Ensure SVG sanitization is enabled.
- Configure a strict Content Security Policy.
- Restrict access to the backend execution API.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-39311.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-39311 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-39311
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-39311 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-39311 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Trilium de TriliumNext, Description: Trilium Notes es una aplicación multiplataforma y jerárquica para tomar notas, centrada en la construcción de grandes bases de conocimiento personales. Las versiones 0.102.1 y anteriores contienen una falla de seguridad crítica donde la falta de saneamiento de SVG combinada con una Política de Seguridad de Contenido (CSP) deshabilitada y una API de ejecución de backend accesible públicamente resulta en una ejecución remota de código (RCE) no autenticada. La vulnerabilidad surge de una arquitectura insegura por diseño: Trilium sirve archivos adjuntos SVG con el tipo MIME image/svg+xml sin ningún saneamiento, y deshabilita explícitamente el middleware de Política de Seguridad de Contenido de Helmet, eliminando la defensa principal contra la ejecución de scripts en los activos servidos. Debido a que el SVG malicioso se ejecuta bajo la Política del Mismo Origen, puede emitir un fetch('/') para extraer el csrfToken del cuerpo del documento. Con ese token, puede enviar una solicitud firmada a /api/script/exec para ejecutar código Node.js arbitrario en el servidor. Un atacante puede comprometer toda la instancia del servidor simplemente engañando a un usuario autenticado para que vea un archivo adjunto SVG compartido. El problema ha sido solucionado en la versión 0.102.2. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'TriliumNext', 'product': 'Trilium', 'versions': [{'status': 'affected', 'version': '< 0.102.2'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-39311', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-20T19:26:55.817058Z'} -
New CVE Received by [email protected]
May. 20, 2026
Action Type Old Value New Value Added Description Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet's Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch('/') to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2. Added CVSS V3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H Added CWE CWE-79 Added CWE CWE-94 Added Reference https://github.com/TriliumNext/Trilium/releases/tag/v0.102.2 Added Reference https://github.com/TriliumNext/Trilium/security/advisories/GHSA-p837-cxw3-m964 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 20, 2026
Action Type Old Value New Value Added Reference https://github.com/TriliumNext/Trilium/security/advisories/GHSA-p837-cxw3-m964