This vulnerability is a client‑side Cross‑Site Scripting (XSS) flaw that exists in usememos Memos v0.26.0. An attacker can inject malicious JavaScript into a memo’s content. When the memo is rendered in the Memo Rendering Component, in the SANITIZE_SCHEMA step, or while viewing a memo via the Public/Private Memo View pages, the injected script is executed in the victim’s browser context. This allows the attacker to steal session cookies, read other memo data, or perform actions on behalf of the user. The weakness corresponds to CWE‑79, which is a classic input‑validation issue that results in script injection.

The flaw is present only in usememos Memos version 0.26.0. No other products or versions were identified as affected in the available data.

The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog, indicating that publicly known exploits have not yet been observed. Nevertheless, the ability to execute arbitrary scripts in the end‑user’s browser represents a serious risk, especially in environments where memos are publicly viewable or shared. A remote attacker can craft a memo with malicious payloads and persuade a user to open it, leading to potential data theft or credential compromise. Because the vulnerability operates across the web interface, the attack vector is inferred to be Remote (Web).