The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.
CVSS Score
9.8
EPSS Score
0.0
Published
2025-07-29
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVSS Score
8.1
EPSS Score
0.0
Published
2024-08-20
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current server request, causing a reflected XSS vulnerability. Version 0.22.0 of memos removes the vulnerable file.
CVSS Score
6.1
EPSS Score
0.002
Published
2024-04-19
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
CVSS Score
7.3
EPSS Score
0.001
Published
2023-09-18
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score
8.8
EPSS Score
0.001
Published
2023-09-01
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score
7.5
EPSS Score
0.012
Published
2023-09-01
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
CVSS Score
9.8
EPSS Score
0.01
Published
2023-09-01
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.
CVSS Score
5.4
EPSS Score
0.001
Published
2023-02-15
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score
9.0
EPSS Score
0.001
Published
2023-01-07
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
CVSS Score
6.5
EPSS Score
0.001
Published
2023-01-07
Page 1