CVE-2026-30586: usememos Memos XSS Vulnerability

CVE-2026-30586 Overview

CVE-2026-30586 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting usememos Memos version 0.26.0. The flaw resides in the SANITIZE_SCHEMA configuration, the Memo Rendering Component, and the Public/Private Memo View pages. A remote attacker can inject malicious script content that executes in a victim's browser when the affected memo is rendered. Successful exploitation allows attackers to obtain sensitive information from authenticated user sessions.

The vulnerability requires user interaction, since a victim must view a crafted memo. The scope is changed, meaning injected scripts can affect resources beyond the vulnerable component.

Critical Impact
Remote attackers can execute arbitrary JavaScript in victims' browsers via crafted memos, leading to sensitive information disclosure across public and private memo views.

Affected Products

usememos Memos v0.26.0
SANITIZE_SCHEMA configuration component
Memo Rendering Component and Public/Private Memo View pages

Discovery Timeline

2026-06-02 - CVE-2026-30586 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-30586

Vulnerability Analysis

Memos is an open-source, self-hosted note-taking and memo application. Version 0.26.0 ships with a sanitization allowlist defined in web/src/components/MemoContent/constants.ts that governs which HTML tags and attributes survive rendering. The allowlist is overly permissive, enabling attacker-controlled markup to reach the DOM during memo rendering.

Because memos can be marked public, an attacker can plant a malicious memo and lure any visitor to the Public Memo View page. When the page renders the memo, the injected script executes under the application's origin. Cookies, local storage tokens, and CSRF-protected actions all become accessible to the attacker's payload.

Root Cause

The root cause is improper neutralization of input during web page generation. The SANITIZE_SCHEMA allowlist used by the Memo Rendering Component does not adequately restrict script-bearing attributes or unsafe tag combinations. The Public/Private Memo View pages then trust the sanitizer output and render the content without additional context-aware encoding.

Attack Vector

The attack is delivered over the network and requires the victim to view a crafted memo. An attacker authenticated to a Memos instance creates a memo containing markup that bypasses SANITIZE_SCHEMA. The attacker shares the memo's public URL or relies on an existing visitor to open a private memo. When the rendering component processes the payload, the embedded JavaScript runs in the viewer's browser session, exfiltrating session data or performing actions on the victim's behalf.

No verified proof-of-concept code has been published. Technical details are referenced in the GitHub Gist disclosure and the vulnerable sanitizer schema source.

Detection Methods for CVE-2026-30586

Indicators of Compromise

Memos containing unusual HTML attributes such as onerror, onload, onclick, or javascript: URIs in stored content
Outbound HTTP requests from user browsers to attacker-controlled domains immediately after loading a memo page
Unexpected session token or cookie access patterns originating from Memos view pages

Detection Strategies

Review the Memos database for stored memo content matching script-injection patterns, including encoded variants such as <script or data:text/html
Inspect web server access logs for requests to /m/{memoId} paths followed by anomalous third-party requests from the same client session
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts on memo view pages

Monitoring Recommendations

Aggregate Memos application logs and browser CSP reports into a centralized analytics platform for correlation
Alert on memo creation events containing HTML event handler attributes or external script references
Monitor for privilege-context actions, such as memo edits or deletions, that occur immediately after a memo view request

How to Mitigate CVE-2026-30586

Immediate Actions Required

Restrict public memo creation to trusted users until a patched release is deployed
Audit existing memos for embedded HTML event handlers or javascript: URIs and remove suspicious content
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to the application origin

Patch Information

No vendor-confirmed patch is referenced in the NVD entry at the time of publication. Administrators should monitor the usememos/memos repository for an updated release that hardens the SANITIZE_SCHEMA allowlist and tightens output encoding in the Memo Rendering Component.

Workarounds

Place Memos behind an authenticating reverse proxy to prevent anonymous access to public memo URLs
Add a restrictive CSP header at the proxy layer to neutralize inline script execution
Disable the public memo feature in instance settings if business requirements allow private-only sharing

bash

# Example NGINX reverse proxy CSP header for Memos
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;