usememos/memos vulnerable to stored cross-site scripting (XSS)
Moderate severity
GitHub Reviewed
Published
Dec 23, 2022
to the GitHub Advisory Database
•
Updated Feb 2, 2023
Description
Published by the National Vulnerability Database
Dec 23, 2022
Published to the GitHub Advisory Database
Dec 23, 2022
Reviewed
Dec 27, 2022
Last updated
Feb 2, 2023
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. This was patched in version 0.9.0.
References