{"uuid": "975bb153-3fde-4b3b-9d5d-c0d1d749d88c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-3067", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/119016", "content": "22.6k+ GitHub Stars Note-Taking App Hit by XSS Vulnerability\n\n22.6k+ GitHub Stars Note-Taking App Hit by XSS Vulnerability CVE-2023\u20133067: Stored Cross Site Scripting Vulnerability on renowned note-taking thick client app TrilliumTrilium Notes is a Hierarchical Note-Taking App for Knowledge BasesIntroduction Every digital creation has flaws, and in this blog, we\u2019ll look at a recent discovery that shook the foundation of this popular open-source hierarchical note-taking application. While testing the thick client application, I discovered stored cross-site scripting vulnerabilities in the Title section, which appeared in an unusual place.Understanding CVE-2023\u20133067: Trilium Notes XSS IssueDescription: A vulnerability was discovered while adding new notes in Trilium Notes where the note titles were immediately shown in the \u201cNote Map\u201d function, possibly permitting HTML injection and cross-site scripting (XSS) attacks on both saved and reflected data. The need for security vigilance cannot be overstated.Affected Versions: The vulnerability is present in versions of Trilium Notes stored in the GitHub repository zadam/trilium prior to version 0.59.4Steps to Reproduce:Begin by downloading the vulnerable version (0.58.0-beta for Windows) from this link.Execute the trilium.exe application.Create a new note within Trillium.Manipulate the Note Title: Name the new note as \">.Visit the \u201cNote Map\u201d: Access the \u201cNote Map\u201d functionality within Trillium.Exploit Triggered: Click on the red dot in the \u201cNote Map\u201d or simply wait for the alert to appear. The XSS attack is now reflected and stored, causing the alert box to pop up every time.Cross-Site-Scripting Payload used: \">Screenshot:When the Red Dot in the Note Map was clicked, the stored XSS was executed, and an alert box appeared.\ud83d\udcfd\ufe0fVideo PoC https://drive.google.com/drive/folders/1Wt_BhUngMjFo3L2_7RhA4gFnYyJTHd5ZWhat did I do Next? I responsibly reported the vulnerability to the huntr.dev platform, which then engaged with the administrator of Trilium\u2019s open-source repository. The report was meticulously validated, assigned an appropriate severity score, and promptly addressed through a new software release. Subsequently, I was honored with the assignment of a CVE for my contribution to the security of the software ecosystem. Officially disclosed report:https://huntr.dev/bounties/4772ceb7-1594-414d-9b20-5b82029da7b6/#bugbounty Official Announcements:https://twitter.com/huntrHacktivity/status/1664648465685815299https://twitter.com/_Raiders/status/1664663048571998208 CVE-2023\u20133067 Detail:https://nvd.nist.gov/vuln/detail/CVE-2023-3067 Thank you for reading \u270c\ud83c\udffb Take care, fellow hackers! Happy Hunting :> You can connect with me on LinkedIn, or Twitter for more such insights! 22.6k+ GitHub Stars Note-Taking App Hit by XSS Vulnerability was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-04T04:00:05.711856Z"}