THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-48996 — Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, all

[NVD] CVE-2026-48996 — Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, all

mednvdPublished 2026-08-27

CVE-2026-48996 CVSS: None Published: 2026-08-27T20:17:47.127

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an attacker-supplied import archive to inject scrip

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-48996cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-48996