Executive brief
Memos, an open-source note-taking application, contains a vulnerability that allows users to create malicious notes that can hijack the visual interface of other users. By including specific formatting and embedded content in a memo, an attacker can overlay a fake login screen or other deceptive content over the entire application window. This can be used to trick users into providing their login credentials while they believe they are still on the legitimate website.
Technical details
A vulnerability exists in the Markdown rendering component of Memos due to an overly permissive sanitization schema in 'rehype-sanitize'. The 'SANITIZE_SCHEMA' configuration allows 'style' attributes on 'span' elements and permits 'iframe' embeds without a 'sandbox' attribute. An authenticated attacker can exploit this by creating a memo containing a 'span' with fixed positioning and high z-index to cover the viewport, containing an 'iframe' pointing to a malicious site. When a victim views the memo, the attacker's content is rendered over the legitimate UI while the browser address bar remains unchanged, enabling highly effective phishing and UI redressing attacks.
Affected products
- usememos Memos <= 0.26.0
Timeline
- 2026-06-01: disclosed: Vulnerability details shared via GitHub Gist.
- 2026-06-02: advisory: CVE-2026-30586 published.