CVE-2022-2290

MEDIUMNuclei

Cross-site Scripting (XSS) - Reflected in zadam/trilium

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-2290 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 29, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

trilium

Browse triliumnotes / trilium
VulnCheckVersion data not supplied

zadam/trilium

Browse zadam / zadam/trilium
CVE ListBefore 0.53.1-betaaffected
0.52.4unaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMTrilium <0.52.4 - Cross-Site ScriptingCVSS 6.1

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected Trilium instance.

Remediation

Upgrade Trilium to version 0.52.4 or later, which includes proper input sanitization to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsdbrwsky
Template tagscvecve2022xsstriliumhuntrtrilium_projectvulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:trilium_project:trilium:*:*:*:*:*:*:*:*
Shodan: title:"Trilium Notes"
Shodan: http.title:"trilium notes"
FOFA: title="trilium notes"
Google: intitle:"trilium notes"
https://huntr.dev/bounties/367c5c8d-ad6f-46be-8503-06648ecf09cf/ https://github.com/zadam/trilium https://github.com/zadam/trilium/commit/3faae63b849a1fabc31b823bb7af3a84d32256a7 https://nvd.nist.gov/vuln/detail/CVE-2022-2290 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3