Description
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.
References (3)
Core 3
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUSEMEMOSMEMOSSERVER-3319070
Scores
CVSS v3
5.4
EPSS
0.0027
EPSS Percentile
50.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
usememos/memos
usememos/memos
0 - 0.10.4-0.20230211093429-b11d2130a084Go
Published
Feb 15, 2023
Tracked Since
Feb 18, 2026