Affected by GO-2023-2036
and 16 other vulnerabilities
GO-2023-2036 : usememos/memos vulnerable to privilege escalation in github.com/usememos/memos
GO-2023-2038 : Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos
GO-2023-2065 : Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos
GO-2024-3046 : memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos
GO-2024-3047 : memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos
GO-2024-3049 : memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos
GO-2024-3088 : memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos
GO-2025-3492 : Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos
GO-2025-3831 : Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos
GO-2025-3936 : Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos
GO-2025-3937 : Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos
GO-2025-4127 : Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos
GO-2025-4215 : memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos
GO-2025-4216 : memos vulnerability allows arbitrarily modification or deletion of attachments in github.com/usememos/memos
GO-2025-4217 : memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos
GO-2025-4218 : memos lacks file name validation or verification in github.com/usememos/memos
GO-2025-4220 : memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos
Discover Packages
github.com/usememos/memos
command
module
Version:
v0.11.0
Opens a new window with list of versions in this module.
Published: Feb 24, 2023
License: MIT
Opens a new window with license information.
Imports: 2
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
README
README
ยถ
Live Demo โข
Discuss in Telegram / Discord
Features
๐ฆ Open source and free forever
๐ Support for self-hosting with Docker in seconds
๐ Plain textarea first and support some useful Markdown syntax
๐ฅ Set memo private or public to others
๐งโ๐ป RESTful API for self-service
๐ Embed memos on other sites using iframe
#๏ธโฃ Hashtags for organizing memos
๐ Interactive calendar view
๐พ Easy data migration and backups
Deploy with Docker in seconds
Docker Run
docker run -d --name memos -p 5230:5230 -v ~/.memos/:/var/opt/memos neosmemo/memos:latest
~/.memos/ will be used as the data directory in your machine and /var/opt/memos is the directory of the volume in Docker and should not be modified.
Docker Compose
docker-compose down && docker image rm neosmemo/memos:latest && docker-compose up -d
Other installation methods
Contribute
Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated. ๐ฅฐ
Learn more about contributing in development guide .
User stories
Acknowledgements
Thanks Uffizzi for sponsoring preview environments for PRs.
License
MIT License
Star history
Expand โพ
Collapse โด
Documentation
ยถ
There is no documentation for this package.
Source Files
ยถ
Directories
ยถ
log
Package log implements a simple logging package.
Package log implements a simple logging package.
plugin
getter is using to get resources from url.
idp/oauth2
Package oauth2 is the plugin for OAuth2 Identity Provider.
Package oauth2 is the plugin for OAuth2 Identity Provider.
Click to show internal directories.
Click to hide internal directories.