GHSA-cgrg-86m5-xm4w

Memos Vulnerable to Stored Cross-Site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-56761

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/usememos/memos	<= 0.22.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-56761 advisory
https://github.com/usememos/memos package
https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147 web
https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48 web
https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples web