GHSA-9w8x-5hv5-r6gw

    Dashboard / Vulnerabilities / GHSA-9w8x-5hv5-r6gw

    GHSA-9w8x-5hv5-r6gw

    Published: 15 Feb 2023Last Modified: 19 Mar 2025

    Summary: Cross Site Scripting in usememos/memos

    Details: All versions of the package github.com/usememos/memos/server prior to 0.11.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-25978, https://github.com/usememos/memos/issues/1026, https://github.com/usememos/memos/commit/b11d2130a084385eb65c3761a3c841ebe9f81ae8, https://pkg.go.dev/vuln/GO-2023-1566, https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUSEMEMOSMEMOSSERVER-3319070, github.com/usememos/memos

    Affected packages

    Package

    Name: github.com/usememos/memos

    Purl: pkg:golang/github.com/usememos/memos

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.10.4-0.20230211093429-b11d2130a084

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-9w8x-5hv5-r6gw | CVE-DB