VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/usememos/memos: vulnerability history, versions and safety

github.com/usememos/memos is a package in the Go ecosystem. Vulert records 138 vulnerabilities for it across 120 releases, from Dec 2022 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
138 vulnerabilities recorded C4 H17 M54 L1 U62
i
15 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
14 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/usememos/memos vulnerabilities

Vulert verdict on github.com/usememos/memos v0.31.0 i

Updated on 23 Oct 2026

Careful: v0.31.0 has 138 known vulnerabilities, and 15 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.31.0 — affected i
  • Vulnerabilities on record 138 over 3 years · 14 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 15 i
  • Stars 63,845 i
  • Last release 1 month ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/usememos/memos, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.31.1-0.20261022011723-008dded234ff 22 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261020131548-48259e602277 20 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261019055840-f0ee2fd4484e 19 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261016162156-1a51572406e1 16 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261015013202-1511fd125df0 15 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261014013128-25419a5239b0 14 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261012150226-7bdf6f275b63 12 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261012012258-a80fe19ee178 12 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261011025203-d77516028364 11 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261010003750-d5df8915f70a 10 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261009143158-d566184a45c5 09 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261005220138-f7a61867315f 05 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20261002221719-0d989707f82c 02 Oct 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260928122021-a80576a6def3 28 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260927145852-cb42e326ba9c 27 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260927020107-65d2278a2e61 27 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260926110458-68db65243a16 26 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260923001908-05a2c6db7a3e 23 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260922011035-ea4b2f1136dd 22 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.1-0.20260920110941-a1c3061c6c53 20 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0 19 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.2.0.20260919161552-78b510fb652d 19 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.2.0.20260918163301-7e3d3c63156c 18 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.2 15 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260914114650-a69d286735d3 14 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260906051517-ad6433c51a4d 06 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260905045139-500bb716bcf7 05 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260903154338-1ed894bee4f5 03 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260902161608-6346bed57fa7 02 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260901153043-245e5e3a3e95 01 Sep 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260831155636-de843f658a8d 31 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260831010415-59541ea438b4 31 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1.0.20260830044904-dcef4188dbfb 30 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.31.0-rc.1 30 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.1-0.20260813160845-14d757ce1fb3 13 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.1-0.20260809152718-bd636a436522 09 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.1-0.20260809082447-6c22f9562b98 09 Aug 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.1-0.20260729010642-c4221c6dfe51 29 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.0 26 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.0-rc.2 20 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.30.0-rc.1 14 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.2-0.20260710005116-a9ac008a689c 10 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.2-0.20260708153747-5329e6040787 08 Jul 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.2-0.20260621145556-cafa56f1a8c9 21 Jun 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.2-0.20260605011722-5e71c0a73740 05 Jun 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.1 05 Jun 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.1-0.20260531105337-fadc97436487 31 May 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.29.0 27 May 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.28.1-0.20260525141029-e53b7d96e709 25 May 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.28.1-0.20260502113518-238f27dea149 02 May 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.28.1-0.20260429143808-9c5c60494442 29 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.28.0 27 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.2-0.20260425132416-0fb83a745dd5 25 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.1 19 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0 18 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.2.0.20260418142835-583c3d24f4d7 18 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.2.0.20260413140924-101704c8eac1 13 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.2.0.20260412131203-d87539a1e126 12 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.2.0.20260412112334-83ed32f11958 12 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.2 10 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.1.0.20260407134706-2d682ae17608 07 Apr 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.27.0-rc.1 31 Mar 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.26.3-0.20260318144257-04f239a2fc74 18 Mar 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.26.2 23 Feb 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.26.1 08 Feb 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.26.1-0.20260202010755-b8029c70efcf 02 Feb 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.26.0 31 Jan 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20260121001223-956ae0ebc53d 21 Jan 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20260120155546-324f7959653d 20 Jan 2026 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20251230152954-d7284fe867b6 30 Dec 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20251219161801-d236ef161126 19 Dec 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20251215151830-6926764b9155 15 Dec 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.4-0.20251212000613-65a19df4beec 12 Dec 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3 25 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251114155807-156908c77f41 14 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251111003105-d1b2c0308b39 11 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251106114244-769dcd0cf9be 06 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251105004855-5f57f48673e2 05 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251102153129-9b72963e08cf 02 Nov 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251031132958-93964827ad95 31 Oct 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.3-0.20251026035834-6cb96ef65e35 26 Oct 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.2 24 Oct 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1 10 Sep 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250819135738-e2454a8ae420 19 Aug 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250815140229-4eb5b67bafe7 15 Aug 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250724045102-53d3978507ff 24 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250722111808-b55904a4284b 22 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250721155528-1a3fc4d87411 21 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250720040216-71181b164057 20 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250718112703-f67532499421 18 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.1-0.20250716160507-40130350c578 16 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.25.0 16 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.5-0.20250705034401-41fdc7a484d2 05 Jul 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.5-0.20250608152123-f2a01d9ccb60 08 Jun 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.5-0.20250607163951-522da2a11437 07 Jun 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.5-0.20250603012438-6d319900d640 03 Jun 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.4 02 Jun 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.4-0.20250531031447-2595e32f83c1 31 May 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.4-0.20250521160533-46d5307d7f21 21 May 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.4-0.20250521121153-c2528c57f038 21 May 2025 C4 H17 M54 L1 U62 MIT No Details →
v0.24.4-0.20250515141501-606924b4c980 15 May 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.3 12 May 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.3-0.20250401120654-4f39e0086846 01 Apr 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.2 23 Mar 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.2-0.20250315045900-c0643ff6fa03 15 Mar 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.1 13 Mar 2025 C4 H17 M54 L1 U62 — No Details →
v0.0.0-20250303012340-7592e5fe7620 03 Mar 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.1-0.20250303012340-7592e5fe7620 03 Mar 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.1-0.20250221092917-f17774cb3b96 21 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.0.0-20250220133836-bc97b66f36bc 20 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.1-0.20250219135524-f8c973c93874 19 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.1-0.20250209142423-ae85dff5e485 09 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.24.0 05 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.23.2-0.20250201003004-2f4c5d7bc21e 01 Feb 2025 C4 H17 M54 L1 U62 — No Details →
v0.23.1 29 Jan 2025 C4 H17 M54 L1 U62 — No Details →
v0.23.1-0.20250129015620-9172e47c33c5 29 Jan 2025 C4 H17 M54 L1 U62 — No Details →
v0.23.1-0.20241216063158-1c255d4e1fe2 16 Dec 2024 C4 H17 M54 L1 U62 — No Details →
v0.23.0 13 Dec 2024 C4 H17 M54 L1 U62 — No Details →
v0.23.0-rc.2.0.20241207042621-cb569c99fdeb 07 Dec 2024 C4 H17 M54 L1 U62 — No Details →
v0.23.0-rc.3 07 Dec 2024 C4 H17 M54 L1 U62 — No Details →

The newest 120 of 394 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 49
  • 2023 13
  • 2024 54
  • 2025 20
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 14 of the 138 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/usememos/memos

The 5 most severe of 138 vulnerabilities recorded for this package

Search all 138 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2022-4686: Authorization Bypass Through User-Controlled Key in github.com/usememos/memos 9.8 critical 0.9.0 23 Dec 2022
CVE-2023-4696: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos 9.8 critical 0.13.2 01 Sep 2023
CVE-2022-4865: Cross-site Scripting vulnerability in github.com/usememos/memos 9.0 critical 0.9.1 31 Dec 2022
CVE-2022-4866: Cross-site Scripting (XSS) in github.com/usememos/memos 9.0 critical 0.9.1 31 Dec 2022
CVE-2023-5036: Cross-Site Request Forgery (CSRF) in github.com/usememos/memos 8.8 high 0.15.1 18 Sep 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/usememos/memos

Is github.com/usememos/memos safe to use?

Vulert records 138 vulnerabilities for github.com/usememos/memos in Go: 4 critical, 17 high, 54 medium and 1 low, plus 62 not yet rated. 15 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/usememos/memos's Vulert package health score?

Vulert scores github.com/usememos/memos 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/usememos/memos affected?

Yes. v0.31.0, the version you would install today, has 138 known vulnerabilities, and 15 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/usememos/memos should I use?

v0.31.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/usememos/memos have?

138 vulnerabilities are recorded for github.com/usememos/memos in the Go ecosystem: 4 critical, 17 high, 54 medium and 1 low, plus 62 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/usememos/memos vulnerabilities disclosed?

14 vulnerabilities were recorded for github.com/usememos/memos in the last 12 months, and the oldest entry in this database dates to 19 Dec 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/usememos/memos are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/usememos/memos for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/usememos/memos version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.