CVE-2026-45733

{
  "id": "CVE-2026-45733",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T15:16:54.270",
  "lastModified": "2026-10-22T22:10:00.250",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0."
    },
    {
      "lang": "es",
      "value": "Trilium Notes es una aplicación multiplataforma de toma de notas jerárquica enfocada en la construcción de grandes bases de conocimiento personal. Antes de la versión 0.103.0, el valor de la etiqueta #iconClass es devuelto sin procesar por getNoteIcon() e insertado sin codificación de atributos HTML en los atributos de clase en apps/cliente/src/widgets/quick_search.ts y apps/cliente/src/services/note_autocomplete.ts, permitiendo que una carga útil almacenada se ejecute automáticamente cuando una víctima abre una nueva pestaña o usa Ctrl+J y, debido a que Electron habilita nodeIntegration y deshabilita contextIsolation, ejecutar comandos del sistema operativo como la víctima. Este problema está solucionado en la versión 0.103.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TriliumNext",
          "product": "Trilium",
          "versions": [
            {
              "version": "< 0.103.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-18T15:32:57.681431Z",
          "id": "CVE-2026-45733",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-83"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/TriliumNext/Trilium/commit/c06939448bcc2879fc3c4d328ff7dc63ed6b5009",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TriliumNext/Trilium/releases/tag/v0.103.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}