Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS by combining a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or type: launcher) with a #docName label that uses ../ path traversal to point at the payload note's API endpoint. The desktop client Electron renderer runs with nodeIntegration enabled, so an RCE is triggered once the payload is executed. This vulnerability is fixed in 0.102.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-30 | 2 | Disclosure2 |
| 2026-06-01 | 1 | Disclosure1 |
Warning: Critical vulnerability in #Trilium. CVE-2026-45668 CVSS: 9.3. Attackers can achieve remote code execution and bypass sanitisation by tricking users into importing a malicious note file. #RCE! #Patch #Patch #Patch
Post summary
A warning announces CVE-2026-45668 as a critical RCE flaw in Trilium capable of bypassing sanitisation via malicious note import, but offers no patch, PoC or evidence of active exploitation.
🚨*CVE* CVE-2026-45668 Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive … https://www.cve.org/CVERecord?id=CVE-2026-45668 ----- Traducción: CVE-2026-45668 Tri… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑45668 for Trilium Notes, noting that a malicious ZIP archive can exploit the application, but does not mention a PoC, exploit code, patch, or active exploitation.
CVE-2026-45668 Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive … https://www.cve.org/CVERecord?id=CVE-2026-45668
Post summary
The snippet references CVE-2026-45668 for Trilium Notes, noting a vulnerability involving malicious ZIP archives prior to version 0.102.2, but offers no further technical or exploit details.