# Vulnerability Summary: Usememos Memos 0.22.1 Cross-Site Scripting Vulnerability ## Overview - **Vulnerability ID**: #79342 - **Vulnerability Type**: Cross-Site Scripting (Stored XSS) - **Description**: The backend gRPC-web endpoint `UpdateInstanceSetting` fails to properly validate user permissions, allowing standard "Member" users to bypass frontend UI restrictions and modify global instance settings. An attacker can navigate to the system settings page and inject malicious JavaScript or CSS into the `additionalStyle` or `additionalScript` fields, directly injecting the settings into the DOM. Since the frontend application (`src/App.tsx`) uses the `innerHTML` property for rendering, the malicious code will execute in the context of every user visiting the site (including administrators). ## Impact Scope - **Affected Versions**: Usememos Memos (version <= 0.22.1) - **Severity Level**: Critical - **Potential Consequences**: - Session Hijacking - Credential Theft - Unauthorized Administrative Actions - Hijack Global Instance Settings ## Remediation - **Fix Status**: Accepted - **Remediation Recommendation**: Fix the access control logic of the `UpdateInstanceSetting` gRPC-web endpoint to ensure only users with administrator privileges can modify global instance settings. ## Proof-of-Concept Exploit Code (POC) ```text src/App.tsx memos_access_token additionalStyle/additionalScript improper authorization ```