Stored XSS in Trilium Notes via WebView Note Sharing

Executive Summary

Trilium Notes versions up to v0.103.0 have a stored cross-site scripting (XSS) flaw in the share renderer for webView notes. This happens because user-controlled #webViewSrc values are not properly escaped as HTML. Attackers with note-authoring rights can inject malicious JavaScript into shared notes, which then executes when any user, including administrators, opens the note.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in Trilium Notes, inspect shared notes for webView notes containing user-controlled #webViewSrc values. Check if HTML escaping is properly implemented by reviewing note content for JavaScript injection attempts or unusual script tags in shared notes.

Useful 0 Not Useful 0

Impact Analysis

If you author or share notes in Trilium Notes v0.103.0 or earlier, an attacker could inject code that runs in your browser when others view the note. This could lead to stolen session cookies, account takeover, or unauthorized actions performed on your behalf. Even as a reader, visiting a crafted note may trigger the malicious script.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data through unauthorized script execution or enabling data breaches. For HIPAA, it may risk protected health information if notes contain such data and are shared with malicious payloads. Organizations must address this to maintain compliance with data protection requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Trilium Notes to a version later than v0.103.0 where the HTML escaping issue is fixed. Review shared notes for any malicious scripts and remove unauthorized JavaScript injections. Restrict note-authoring privileges to trusted users only.

Useful 0 Not Useful 0