MEDIUM 5.4 NVD

CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.

References

https://vokecyber.com/research/trilium-share-renderer-stored-xss

Published: 2026-09-14 · Source: NVD · Feed updated: 2026-09-15

This medium severity vulnerability with a CVSS score of 5.4 was published on 2026-09-14 via NVD.

vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.