CVE-2023-0109 json
Stored XSS in usememos/memos
published 2024-11-15 23 mo ago modified 2026-06-17 4 mo ago also GHSA-5r2g-59px-3q9w , GO-2024-3274 , EUVD-2024-3199
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
Patch / fix
- go github.com/usememos/memos 0.10.0
- usememos usememos/memos 0.10.0
- usememos memos 0.10.0
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20241119T173509-1.1
opensuse advisories openSUSE-SU-2024:14513-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/usememos/memos | <0.10.0 |
0.10.0 |
Affected products
- usememos usememos/memos
- usememos memos
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c
web, patch
-
huntr.com
/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-0109
advisory
-
github.com
/usememos/memos
package
-
pkg.go.dev
/vuln/GO-2024-3274
web
-
github.com
/advisories/GHSA-5r2g-59px-3q9w
advisory
Sources
- CVE List CVE-2023-0109
- GitHub Advisory GHSA-5r2g-59px-3q9w
- NVD CVE-2023-0109
- OSV GO-2024-3274
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.