https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:12:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362461 EUVD-2026-362461 https://cve.radiocsirt.org/vuln/euvd-2026-362461 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47727 <p>Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on &#34;Safe import&#34; filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note&#39;s raw bytes into ejs.render, which compiles them in the server&#39;s Node process. An unauthenticated request to the shared note then executes the attacker&#39;s JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.</p> <p>Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on &#34;Safe import&#34; filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side template that leads to remote code execution. The relation is omitted from the built-in list of dangerous attributes, so unlike other code-loading relations it is not disabled on import, and when the victim later publishes the imported note the public share renderer feeds the linked EJS code note&#39;s raw bytes into ejs.render, which compiles them in the server&#39;s Node process. An unauthenticated request to the shared note then executes the attacker&#39;s JavaScript with full access to require, process, the filesystem, and the network. This issue is fixed in version 0.104.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47727