Is CVE-2026-30586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30586 being exploited in the wild.

How severe is CVE-2026-30586?

Informational severity, with a CVSS score of 7.7, published 2 June 2026.

Is there a fix for CVE-2026-30586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30586 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-30586?

Check whether you run Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30586: usememos Memos HTML injection and UI redressing in SANITIZE_SCHEMA

CVE-2026-30586 · Severity: info · CVSS 7.7 · Published 2026-06-02

Memos, an open-source note-taking application, contains a vulnerability that allows users to create malicious notes that can hijack the visual interface of other users. By including specific formatting and embedded content in a memo, an attacker can overlay a fake login screen or other deceptive content over the entire application window. This can be used to trick users into providing their login credentials while they believe they are still on the legitimate website.

Technologies: Usememos Memos. Vendors: Usememos.

Quick answers

Is CVE-2026-30586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30586 being exploited in the wild.
How severe is CVE-2026-30586?: Informational severity, with a CVSS score of 7.7, published 2 June 2026.
Which products and versions are affected?: Usememos Memos <= 0.26.0.
Is there a fix for CVE-2026-30586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30586 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-30586?: Check whether you run Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Markdown rendering component of Memos due to an overly permissive sanitization schema in 'rehype-sanitize'. The 'SANITIZE_SCHEMA' configuration allows 'style' attributes on 'span' elements and permits 'iframe' embeds without a 'sandbox' attribute. An authenticated attacker can exploit this by creating a memo containing a 'span' with fixed positioning and high z-index to cover the viewport, containing an 'iframe' pointing to a malicious site. When a victim views the memo, the attacker's content is rendered over the legitimate UI while the browser address bar remains unchanged, enabling highly effective phishing and UI redressing attacks.

Affected products

usememos Memos <= 0.26.0

Timeline

2026-06-01: disclosed: Vulnerability details shared via GitHub Gist.
2026-06-02: advisory: CVE-2026-30586 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.