CVE-2026-115324: mem0 0.1.117 to before 1.0.8

Affected technology

mem0 · 0.1.117 to before 1.0.8
mem0ai

Description’s affected range: before 1.0.8

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high.