Supperhellokitty20

**Name of the Vulnerable Software and Affected Versions** Trilium versions prior to 0.104.0 **Description** The Safe import filter fails to neutralize the `shareTemplate` relation because it is not marked as dangerous. This allows an attacker to provide a malicious import archive that plants a server-side template. When the victim publishes the imported note, the public share renderer passes the raw bytes of the linked EJS (Embedded JavaScript templates) code note into the `ejs.render()` function, which compiles them within the server's Node process. Consequently, an unauthenticated request to the shared note executes the attacker's JavaScript, granting full access to `require`, `process`, the filesystem, and the network, leading to remote code execution. **Recommendations** Update to version 0.104.0.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 **Description** An authenticated user with workflow edit access can configure a 'Respond to Webhook' node to serve binary content using an attacker-controlled `Content-Type`. This binary response path bypasses the central Content-Security-Policy (a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting) sandbox header. Consequently, a public webhook can execute JavaScript within the n8n origin when accessed by an authenticated user, granting access to that user's session. **Recommendations** Update to version 1.123.55. Update to version 2.25.7. Update to version 2.26.2. Limit workflow creation and editing permissions to fully trusted users only. Disable the 'Respond to Webhook' node by adding `n8n-nodes-base.respondToWebhook` to the `NODES EXCLUDE` environment variable.