Affected by GO-2023-2065 and 14 other vulnerabilities

GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3831: Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2025-4215: memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos

GO-2025-4216: memos vulnerability allows arbitrarily modification or deletion of attachments in github.com/usememos/memos

GO-2025-4217: memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos

GO-2025-4218: memos lacks file name validation or verification in github.com/usememos/memos

GO-2025-4220: memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos

memos

command module

v0.14.3 Latest Latest Go to latest Published: Aug 5, 2023 License: MIT Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/usememos/memos

Links

README ¶

memos

A privacy-first, lightweight note-taking service. Easily capture and share your great thoughts.

Documentation • Live Demo • Discuss in Discord / Telegram

demo

Key points

Open source and free forever. Embrace a future where creativity knows no boundaries with our open-source solution – free today, tomorrow, and always.
Self-hosting with Docker in just seconds. Enjoy the flexibility, scalability, and ease of setup that Docker provides, allowing you to have full control over your data and privacy.
Pure text with added Markdown support. Say goodbye to the overwhelming mental burden of rich formatting and embrace a minimalist approach.
Customize and share your notes effortlessly. With our intuitive sharing features, you can easily collaborate and distribute your notes with others.
RESTful API for third-party services. Embrace the power of integration and unleash new possibilities with our RESTful API support.

Deploy with Docker in seconds

docker run -d --name memos -p 5230:5230 -v ~/.memos/:/var/opt/memos ghcr.io/usememos/memos:latest

The ~/.memos/ directory will be used as the data directory on your local machine, while /var/opt/memos is the directory of the volume in Docker and should not be modified.

Learn more about other installation methods.

Contribution

Contributions are what make the open-source community such an amazing place to learn, inspire, and create. We greatly appreciate any contributions you make. Thank you for being a part of our community! 🥰

Moe Memos - Third party client for iOS and Android
lmm214/memos-bber - Chrome extension
Rabithua/memos_wmp - WeChat MiniProgram
qazxcdswe123/telegramMemoBot - Telegram bot
eallion/memos.top - Static page rendered with the Memos API
eindex/logseq-memos-sync - Logseq plugin
JakeLaoyu/memos-import-from-flomo - Import data. Support from flomo, wechat reading
Send to memos - A shortcut for iOS
Memos Raycast Extension - Raycast extension
Memos Desktop - Third party client for MacOS and Windows
MemosGallery - A static Gallery rendered with the Memos API

Acknowledgements

Thanks Uffizzi for sponsoring preview environments for PRs.

Star history

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

Path	Synopsis
api
auth
v1
v2
cmd
common
log Package log implements a simple logging package.	Package log implements a simple logging package.
util
plugin
gomark
gomark/ast
gomark/parser
gomark/parser/tokenizer
gomark/renderer
http-getter Package getter is using to get resources from url.	Package getter is using to get resources from url.
idp
idp/oauth2 Package oauth2 is the plugin for OAuth2 Identity Provider.	Package oauth2 is the plugin for OAuth2 Identity Provider.
openai
storage/s3
telegram
proto
gen/api/v2 Package apiv2 is a reverse proxy.	Package apiv2 is a reverse proxy.
server
profile
version
store
db
test
server
store

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL