-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a CSRF-triggered XSS chain. The patch adds HTML sanitization via bluemonday to the GetImage() function, indicating it previously returned unsanitized content. While the CVE is labeled as CSRF (CWE-352), the root code vulnerability lies in GetImage's lack of output sanitization, which allowed XSS payloads to be injected via CSRF requests. The function's role in fetching external content made it the critical point where sanitization was missing, enabling the exploit chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | < 0.15.1 | 0.15.1 |