CVE-2026-45733Proof of concept (PoC) published · CISA
Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
CVSS score
8.3
EPSS probability
%0.4
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.6
CVE-2026-47727
Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
T
Patch verifiedEPSS %1
8.1
CVE-2026-53580
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
T
Patch verifiedEPSS %0
7.5
CVE-2026-77438
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
T
Patch status unknownEPSS %0
9.3
CVE-2026-53579
Trilium: Note Import to RCE via Book Note
T
Patch verifiedEPSS %0
9.3
CVE-2026-53578
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
T
Patch verifiedEPSS %0
9.3
CVE-2026-48996
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
T
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-45733"