What is GHSA-g94c-cfqp-6xq2?

GHSA-g94c-cfqp-6xq2 is a security advisory published by GitHub Security Advisories with Medium severity. Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS)...

Which CVE IDs does GHSA-g94c-cfqp-6xq2 cover?

GHSA-g94c-cfqp-6xq2 covers the following CVE IDs: CVE-2026-91021. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g94c-cfqp-6xq2?

GHSA-g94c-cfqp-6xq2 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-g94c-cfqp-6xq2MediumCVSS 5.4

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS)...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-91021 →

📋 Description

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-91021
https://vokecyber.com/research/trilium-share-renderer-stored-xss
https://github.com/advisories/GHSA-g94c-cfqp-6xq2