GitHub Advisoryadvisory · PyPI

GHSA-7587-9684-52r6 mem0ai Databricks vector store vulnerable to SQL injection

CRITICAL Published 2026-10-22 Modified 2026-10-23 Official page ↗
Aliases
CVE-2026-115324
Ecosystem
PyPI
Packages
mem0ai
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-10-23

Affected packages

• PyPI mem0ai: >= 0.1.117, < 1.0.8 → fixed in 1.0.8

Description

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

Related

Alias · CVE (1)

  • CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References