Skip to content

Trilium

v0.103.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

electron electron-app knowledge-base knowledge-graph knowledge-management knowledge-management-graph
+12 more
local-first note-managment note-taker note-taking notebook notes notes-app personal-knowledge-base personal-wiki scriptable self-hosted wiki

Affected surfaces

breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 13d

SQL injection via an unsanitized URL in getDayNotesForMonth and stored XSS via unescaped shareExternalLink are present. The database and sync versions have increased, mandating upgrades for continued syncing.

Why it matters: Patch immediately to fix the SQL injection (CVSS ≈ 7) and stored XSS vulnerabilities; upgrade both desktop and server before the next sync cycle to avoid data loss or corruption.

Summary

AI summary

Database and sync versions increased, requiring both desktop and server upgrades to maintain syncing.

Changes in this release

Security Medium

SQL Injection via unsanitized URL in getDayNotesForMonth

SQL Injection via unsanitized URL in getDayNotesForMonth

Source: llm_adapter@2026-05-21

Confidence: low

Security Medium

Stored XSS via unescaped shareExternalLink in share

Stored XSS via unescaped shareExternalLink in share

Source: llm_adapter@2026-05-21

Confidence: low

Breaking Medium

api.axios removed from backend scripting

api.axios removed from backend scripting

Source: llm_adapter@2026-05-21

Confidence: high

Breaking Medium

Database and sync version increased, requires upgrade

Database and sync version increased, requires upgrade

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

PDF inline toolbar with highlight and comment

PDF inline toolbar with highlight and comment

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Backend script API to execute other scripts

Backend script API to execute other scripts

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Syntax highlighting for code blocks in Markdown

Syntax highlighting for code blocks in Markdown

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Custom dictionary synchronized across instances

Custom dictionary synchronized across instances

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Mermaid Venn and Ishikawa diagram types

Mermaid Venn and Ishikawa diagram types

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Relation map rename relations via context menu

Relation map rename relations via context menu

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

AppImage deployment for Linux introduced

AppImage deployment for Linux introduced

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Download button for backups

Download button for backups

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Video and audio player design improved

Video and audio player design improved

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Revisions with rich diff and source indication

Revisions with rich diff and source indication

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Bookmarks renamed to Anchors, integrated links

Bookmarks renamed to Anchors, integrated links

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Include notes with sizing and expandability

Include notes with sizing and expandability

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

PDF read-only support added

PDF read-only support added

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Spreadsheets note type with Excel-like editing

Spreadsheets note type with Excel-like editing

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Markdown support with preview and sync scrolling

Markdown support with preview and sync scrolling

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

OCR support for images, PDF, Office files

OCR support for images, PDF, Office files

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

LLM chat functionality reintroduced with full chats

LLM chat functionality reintroduced with full chats

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

Revisions now support rich diff, manual description, source tagging, and keyboard shortcut for named actions

Revisions now support rich diff, manual description, source tagging, and keyboard shortcut for named actions

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Feature Medium

Bookmarks renamed to Anchors, integrated into link‑add feature with slash command support

Bookmarks renamed to Anchors, integrated into link‑add feature with slash command support

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Feature Medium

Include notes now support resizing, expandable option, and remember default size

Include notes now support resizing, expandable option, and remember default size

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Feature Medium

PDF viewer now offers read‑only mode disabling editing features

PDF viewer now offers read‑only mode disabling editing features

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Performance Medium

Database performance improved by adding indices

Database performance improved by adding indices

Source: llm_adapter@2026-05-21

Confidence: high

Performance Medium

Performance issues from excessive document saving

Performance issues from excessive document saving

Source: llm_adapter@2026-05-21

Confidence: low

Performance Medium

Search performance improved with caches

Search performance improved with caches

Source: llm_adapter@2026-05-21

Confidence: low

Performance Medium

Reduced excessive document saving causing input lag during editing

Reduced excessive document saving causing input lag during editing

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Performance Medium

Search performance enhanced with caching and algorithm optimizations

Search performance enhanced with caching and algorithm optimizations

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Deprecation Medium

api.cheerio marked as deprecated in scripting

api.cheerio marked as deprecated in scripting

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

CSRF errors on mobile requiring refresh

CSRF errors on mobile requiring refresh

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Can't print or export PDF on Linux Wayland

Can't print or export PDF on Linux Wayland

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Protecting notes not refreshing tree state

Protecting notes not refreshing tree state

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Server not running in hidden directory

Server not running in hidden directory

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Invalid canvas note crashes full-text search

Invalid canvas note crashes full-text search

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Server fails to run when placed in a hidden directory (e.g., ~/.local/share)

Server fails to run when placed in a hidden directory (e.g., ~/.local/share)

Source: granite4.1:30b@2026-05-22-audit

Confidence: low

Full changelog

v0.103.0

[!NOTE]
If you enjoyed this release, consider showing a token of appreciation by:

[!IMPORTANT]
Due to the introduction of new note types (spreadsheet) and the OCR feature, the database and sync versions have been increased. This means that both the desktop and the server need an upgrade in order to continue syncing.

[!WARNING]
The Windows binary has received a certificate upgrade which means that you might get SmartScreen warnings depending on how you install the application. This is already a known issue, the workaround is to right click the installer → Properties and check the security box at the bottom of the window.

💡 Key highlights

  1. A long-awaited note type is now supported: Spreadsheets, allowing for a familiar (Excel-like) editing experience with formulas, powered by Univer Sheets.
    • Support for it is considered beta and it might face some changes along the way.
    • See the documentation for important aspects to consider when using spreadsheets.
  2. Basic Markdown support with preview and sync scrolling.
  3. Built-in OCR support for images, but also PDF and Office (Word, PowerPoint, Spreadsheet) text extraction which integrates with the search function. See the Media page in Options for configuration.
  4. Custom dictionary is now synchronized across instances
  5. New deployment for Linux under test: AppImage
  6. Bookmarks in text notes were overhauled
    • Bookmarks were renamed to Anchors in order not to overlap with the concept of bookmarked notes in Trilium.
    • Anchors can now be used across notes as they are integrated into the Add link feature. See documentation for more information.
    • Added a corresponding slash command to make it easy to introduce new anchors.
  7. We are reintroducing an LLM chat functionality with full-size chats as well as a sidebar with tools that allow it to alter your notes or even create scripts.

🚨 Breaking changes

  • Back-end scripting:
    • api.axios has been removed. It has already been marked as deprecated for more than two years now and given the recent security compromise and the fact that it's not actually used in the Trilium code base we took the decision to remove it completely. Please update your scripts to use the built-in fetch() instead.
    • api.cheerio has been marked as deprecated, but not removed. As an alternative we provide node-html-parser which has a more DOM-oriented syntax.

🐞 Bugfixes

  1. Save indicator not showing in quick edit popup.
  2. Grid of child notes does not clear floats.
  3. Open tabs would load in the background, causing a slight performance impact.
  4. New layout:
  5. Missing empty icon from the default icon pack.
  6. Board collection:
    • Scrolling horizontally was clipped.
    • Add button not snappable to on mobile.
  7. Invalid canvas note crashes full-text search
  8. Protecting or un-protecting notes does not refresh the state of the tree.
  9. Collections will show the note list even if a protected session is not available.
  10. Notes created from within a collection don't respect the protected state.
  11. Long-standing issue with CSRF errors on mobile, which required a refresh.
  12. Setup text in DarkMode is hardly legible
  13. Share: Browsing to "/share" on uninitialized setup causes crash
  14. Large Equations Render over editor using Latex align environment in Display Mode
  15. New layout: attribute detail modal not visible
  16. The first attribute value fails to pop up the label details window correctly
  17. Thumbnail images in version v0.102.1 are too small
  18. PDF previews can fail between software updates due to caching issues
  19. Can't print or export to PDF on Linux Wayland
  20. Browsing to "/share" on uninitialized setup causes crash by @argusagent
  21. Refresh content for SPAs with "query string" in hash by @contributor
  22. Import file with Chinese char in file name cause random char in file name after import
  23. Share: Webviews occupy too little height, making them hard to see
  24. Events in calendar show as light even when dark theme is selected
  25. Scripting: Preact's useContext is exported, but createContext isn't
  26. Share Function - Translation not being used
  27. Changing the note icon does not change the icon in the tab
  28. Cannot open quick search results in new tab
  29. Server & desktop not running properly if placed in a hidden directory (e.g. ~/.local/share).
  30. Collections:
    * Not reacting to changes in note reordering.
    * Clicking on a URL promoted attribute in board will also open quick edit.
  31. Performance issues when typing caused by saving the document too many times (addresses Significant input lag and UI freezing during continuous drawing/writing (Mouse & Pen) but also other note types as well)
  32. Unnecessary attribute setting when editing a note in a calendar's quick edit.
  33. Title is no longer auto-selected when creating a new note
  34. Note Map view of Hidden Notes freezes Trilium
  35. Search: Some user-facing error messages were not translated.
  36. Uncaught TypeError shown in logs when switching notes with bottom-right attribute window open
  37. Demo spacing and formatting issues
  38. Setup doesn't support trailing slash for sync
  39. "Open Command Palette" shortcut opens with the '>' symbol highlighted
  40. Unable to set column value to zero in table view
  41. Displaying deep child notes in the Journal calendar view
  42. Titles of Options are renamable
  43. New layout sidebar
    * Table of contents sometimes renders math equations multiple times
    * Highlights list does not show equations.
  44. Deleting a not displayed note will change the displayed note
  45. Demo notes: statistics not working due to missing Chart.js
  46. Disable "Internal trilium link (Ctrl+L)" on code-block text selection
  47. Orphaned keyboardShortcuts* options after upgrade
  48. Scripting: Logging complex entities such as api.startNote would show [object Object]
  49. Import from HTML does not restore indentation
  50. Mermaid:
    * Mermaid diagram copy reference to clipboard button is broken
    * Issue with Chinese Paths on Windows
  51. Add an error when link couldn't be opened
  52. UI overlap in attribute editing by @ZAKIURREHMAN
  53. Some launch bar context menus were intercepted by the browser.
  54. ENEX import: Attachments should not be converted into separate pages
  55. Exporting code of type Markdown resulted in a .mkd or .code (for GFM).
  56. Importing a Markdown file with “Import as text note” disabled would import as the wrong format (File) instead of Code.
  57. Text notes would print with a different font than the one in body.
  58. The hidden notes hiearchy becomes apparent after importing a note into root
  59. No focus in “Choose note type” dialog
  60. Markdown import: Wrong management of backtick-escaped triple backtips
  61. Safe import strips out bookmarks from note
  62. Printing: Reference links not shown by @contributor
  63. For publicly shared pages, the checkbox does not display on dark theme
  64. PDF: Not reacting to deleting highlights or moving them around
  65. The help button in a dialog now opens in a separate dialog instead of closing that dialog.
  66. Clicking on “Full search syntax help” doesn't work.
  67. Breadcrumb: Children hidden from tree are still listed
  68. Settings: Slashes not displayed well in the backup toast
  69. Code notes: Line numbers are lacking a background.
  70. Renaming an attachment won't update its name from the list.
  71. Tooltips in left Sidebar after unlocking db still showing [protected]
  72. Dropdown menu transparency causes readability issue by @adoriandoran
  73. Switching from “View source” to another note would not show the inline actions.
  74. Trilium not recovering after system suspension on Ubuntu Snap

✨ Improvements

  1. Videos & audio files imported in Trilium now have a new default icon and the extension will be trimmed.
  2. Improved the design of the video and audio player and added additional functionality such as easy seeking, rotation, picture-in-picture.
  3. Mermaid:
    • Added a list of example diagrams that are shown when Mermaid notes are empty, for getting started quickly. All the supported diagrams types were added.
    • As a result of the previous change, new Mermaid diagrams start out as empty instead of a generic flowchart diagram.
    • Updated the version of Mermaid which brings in two new diagram types: Venn and Ishikawa.
  4. Space mobile launcher container evenly by @Mystler
  5. PDF: Inline toolbar with highlight and comment by @contributor
  6. Add Catppuccin theme to both code notes and code blocks by @giuxtaposition
  7. Added four more themes to code notes: High Contrast Dark, High Contrast Light, Material Ocean, and Synthwave '84
  8. Relation map: Add more options to open notes in the context menu
  9. Improve database performance by adding new indices (by @perfectra1n).
  10. CKEditor was updated to v48 with the most notable change of being able to change the alignment of tables with or without text wrapping (see #5791).
  11. Mermaid diagrams were updated which brings in two new diagram types: TreeView and Wardley Maps.
  12. Inline mermaid diagrams use a more modern approach to rendering, which should reduce flicker.
  13. Relation map: rename relations through context menu
  14. Share: Render dates on the client to match their locale.
  15. Backend script: add an API to execute other backend scripts.
  16. Download button for backups by @Lorinc936
  17. Search:
    * Improve the error messages to be more user-friendly when searching for keywords without quotes or entering text after expressions
    * Add a way to open all the results in a new tab
    * Improve search performance by using caches and optimizing algorithms by @perfectra1n
    * Option to easily toggle the fuzzy search on/off by @perfectra1n
    * Option to disable fuzzy search in copy/clone
  18. Displaying note icon when creating an inline note link, using @
  19. Friendly numbers in settings: Sync timeout and Zoom factor (percent better than decimal factor)
  20. Copy button for inline code (via toolbar for editable notes and clicking for read-only notes)
  21. Admonitions now have a floating toolbar to quickly change their type.
  22. Warn if user is trying to run the script in a wrong environment
  23. Open internal link (bookends:, highlights:) in OSX apps
  24. Script execution should error out on usage of protected notes outside of protected session
  25. "Delete all clones" checkbox should have a different message if there are no clones
  26. Improve note path display to use chevrons instead of slashes to separate notes
  27. Changing the size of include notes after they were created
  28. Add 'Expandable' option to Include Note feature
  29. Remember default box size for included notes
  30. Hide hidden notes from similar notes view
  31. Modernized a bit the delete preview.
  32. Improved all the settings pages by using a unified layout, more interactive widgets for layout, theme selection and making use of modals. Some cards were combined together.
  33. “View source” is now searchable.
  34. Every item on the launch bar now has a contextual menu which allows easily removing the item from the bar.
  35. Attachments: preview text in files, provided the MIME type is correct.
  36. Syntax highlighting for code blocks inside Markdown notes
  37. Provide a way to customize Electron data directory
  38. Printing text notes now respects the font selection in settings.
  39. Revisions:
    * Basic rich diff when comparing text note
    * Allow adding a description to manually created revisions
    * Automatically tag revisions based on their source.
    * Improve diff for code notes, by preserving monospace.
    * Indicate the source of a revision: manual save, automatic snapshot, ETAPI, LLM change
    * Keyboard shortcut and option in note menu to save a named action.
  40. Redesign of the about dialog by @adoriandoran
  41. Note attributes pane: add a help button
  42. Tree: do not allow to hide the children of the root element
  43. Improved keyboard markers in Text notes
    * Improved style
    * Can now be exited out of by moving the cursor, just like inline code.
  44. PDF
    * Added read-only support to disable editing features.
    * Shared notes now render using the browser's internal PDF viewer which allows downloading and bypasses some potential issues with reverse proxies.
    * UI language was not always set correctly.
    * Can now be printed or searched through from the note actions menu.
  45. Sidebar (new layout):
    * Improved the layout slightly.
    * PDF page preview: use virtualization for better performance in large documents.
    * PDF highlights and annotations are now listed in the sidebar in a separate section
  46. Import: Support ZIPs with GBK encoding
  47. Attachments list: improve the display when there are no attachments.
  48. Syntax highlighting for Markdown now follows the GitHub flavor.
  49. Reintroduced the sync indicator for mobile (useful when using the third-party Pocket Trilium app).
  50. API logging:
    * api.log now supports multiple arguments, similar to the syntax of console.log.
    * API log text not selectable.
  51. Various UI improvements by @adoriandoran
  52. LLM: Stop generation button by @Kureii

📖 Documentation

  1. How spell check works, including custom dictionary.
  2. Word count widget doesn't mention the use of attribute
  3. Dedicate page for the license
  4. Improved resetting password
  5. Documented the concept of content width.
  6. Broken image for linux distribution in README by @vayungodara

🌍 Internationalization

  1. Czech support by @Kureii
  2. Wrong password message not translated.
  3. Added Uyghur as content language

🛠️ Technical updates

  1. Remove Knockout from setup page by @JYC333
  2. Many dependency updates.

🔒️ Security improvements

  1. Low: SQL Injection via Unsanitized URL Parameter in `getDayNotesForMonth`
  2. Low: Stored XSS via unescaped shareExternalLink label in share index page

Breaking Changes

  • Database schema and sync version have been increased; both desktop app and server must be upgraded to continue syncing.

Security Fixes

  • GHSA-64fm-4j23-99j2 — Low severity SQL injection via unsanitized URL parameter in `getDayNotesForMonth`
  • GHSA-97mx-2qjm-qhfx — Low severity stored XSS via unescaped shareExternalLink label

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Trilium

Get notified when new releases ship.

Sign up free

About Trilium

Build your personal knowledge base with Trilium Notes

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]