Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2022-4690: GitHub memos Repository Allows Attacker-Controlled Content
CVE-2022-4690 · published 3 years ago
Summary
A security issue in older versions of the GitHub memos repository allows an attacker to inject malicious code into the system. This could potentially allow attackers to steal sensitive information or take control of user accounts. Update to version 0.9.0 or later to fix this issue.
What to do
- Update github.com usememos to version 0.9.0.
- Update usememos memos to version 0.9.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | usememos |
< 0.9.0 Fix: upgrade to 0.9.0
|
| – | usememos | memos |
< 0.9.0 cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
References
- https://github.com/usememos/memos/pull/833
- https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5...
- https://github.com/advisories/GHSA-c8jh-vcjh-fx2w
- https://huntr.dev/bounties/7e1be91d-3b13-4300-8af2-9bd9665ec335 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4690.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-4690 Vendor Advisory
- https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf8... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
7.1
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Dec 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta