CVE-2026-91021

CVE-2026-91021 PUBLISHED

Description (CNA)

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.

Affected (CNA)

Vendor / product	Versions
Trilium / Trillium Notes	affected 0 through v0.103.0

CWE

No CWE identifiers supplied.

References

https://vokecyber.com/research/trilium-share-renderer-stored-xss

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.