Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

triliumnext/trilium

              main @ bf194b1
            

126

Fixes

CVEs

CRITICAL

Peak severity

39.4%

Coverage

Highlights

Auth Bypass: 38 prior fixes. Scrutinize any change in this area.

apps/desktop/src/services/web_contents_security.ts: most-fixed (8 issues). Treat as high-risk during review.

69 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Session fixation and missing subject identifier matching during OpenID Connect OAuth callbacks allowed unauthorized login and privilege elevation. Session regeneration and constant-time scrypt comparison were introduced to secure the flow.

Sandbox Escape: Misconfigured webview configurations and loose webContents creation options allowed guest embeds to escape the sandbox, access privileged partitions, or bypass navigation guards allowing localhost routing. Fixes pinned strict partitions and enforced deny-by-default permission handlers.

Stored XSS: Parsing rich media and markdown note attachments (such as MindMaps, chat components, and document imports) exposed users to Stored XSS via raw HTML rendering. Security was achieved by mandating recursive DOMPurify sanitization.