CVE-2022-25978: Usememos Memos

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.

Affected products

• Usememos Memos: any version

Published 2023-02-15. Last modified 2026-06-17.