CVE-2026-48996

Name of the Vulnerable Software and Affected Versions Trilium versions prior to 0.104.0

Description The Safe import filter fails to sanitize note titles. The GeoMap note view interpolates a marker note title into raw HTML rendered as innerHTML, which allows an attacker-supplied import archive to inject scripts that execute when the map is displayed. Since the filter does not escape titles, an HTML event-handler payload can survive the import process. On the desktop client, the Electron renderer operates with Node integration enabled, allowing the injected JavaScript to escalate from cross-site scripting to remote code execution on the victim's machine.

Recommendations Update to version 0.104.0.