Affected by GO-2023-2036 and 16 other vulnerabilities

GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3831: Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2025-4215: memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos

GO-2025-4216: memos vulnerability allows arbitrarily modification or deletion of attachments in github.com/usememos/memos

GO-2025-4217: memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos

GO-2025-4218: memos lacks file name validation or verification in github.com/usememos/memos

GO-2025-4220: memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos

memos

command module

v0.11.2 Latest Latest Go to latest Published: Mar 11, 2023 License: MIT Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/usememos/memos

Links

README ¶

Live Demo • Discuss in Telegram / Discord

demo

Key points

Open source and free forever
Self-hosting with Docker in seconds
Markdown support
Customizable and sharable
RESTful API for self-service

Deploy with Docker in seconds

docker run -d --name memos -p 5230:5230 -v ~/.memos/:/var/opt/memos neosmemo/memos:latest

The ~/.memos/ directory will be used as the data directory on your local machine, while /var/opt/memos is the directory of the volume in Docker and should not be modified.

Learn more about other installation methods.

Contribution

Contributions are what make the open-source community such an amazing place to learn, inspire, and create. We greatly appreciate any contributions you make. Thank you for being a part of our community! 🥰

Here are some products made by our community:

Moe Memos - Third party client for iOS and Android
lmm214/memos-bber - Chrome extension
Rabithua/memos_wmp - WeChat MiniProgram
qazxcdswe123/telegramMemoBot - Telegram bot
eallion/memos.top - Static page rendered with the Memos API
eindex/logseq-memos-sync - Logseq plugin
JakeLaoyu/memos-import-from-flomo - Import data. Support from flomo, wechat reading
Send to memos - A shortcut for iOS
Memos Raycast Extension - Raycast extension
Memos Desktop - Third party client for MacOS and Windows

Acknowledgements

Thanks Uffizzi for sponsoring preview environments for PRs.

Star history

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

Path	Synopsis
api
cmd
common
log Package log implements a simple logging package.	Package log implements a simple logging package.
plugin
http_getter Package getter is using to get resources from url.	Package getter is using to get resources from url.
idp
idp/oauth2 Package oauth2 is the plugin for OAuth2 Identity Provider.	Package oauth2 is the plugin for OAuth2 Identity Provider.
openai
storage/s3
server
profile
version
store
db

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL