What’s Vulnerable › Vulnerabilities

CVE-2022-2290: Cross-site Scripting (XSS) - Reflected in zadam/trilium

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-03 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.

Affected products

• TriliumNext Trilium: before 0.52.4 — fixed in 0.52.4

How to fix

Upgrade to a fixed version: TriliumNext Trilium 0.52.4. Check the vendor advisory for mitigations.

References

• https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7
• https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf
• https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7
• https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf

Get alerted when CVE-2022-2290 or the next vulnerability affects your stack