SQL Injection Vulnerability in mem0 Product by mem0ai
CVE-2026-115324

9.2CRITICAL

Key Information:

Vendor

Mem0ai

Status
Mem0
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115324?

The mem0 product version 0.1.117 and earlier suffer from a SQL injection vulnerability that can be exploited through the manipulation of stored memory elements. Specifically, attackers can craft malicious input targeting memory text, metadata, or message names which, when passed through unescaped insert() and update() functions in the mem0/vector_stores/databricks.py file, may allow execution of arbitrary SQL commands on the connected Databricks SQL warehouse. Prompt action is recommended to patch affected versions.

Affected Version(s)

mem0 0.1.117 < 1.0.8

mem0 1.0.8

References

https://github.com/mem0ai/mem0/issues/4073
issue-tracking
https://github.com/mem0ai/mem0/pull/4558
patchissue-tracking
https://github.com/mem0ai/mem0/commit/a2ffca32660537b7b30...
patch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212 (Lighthouse Research Project)
leediay153 from Viettel Post
.