CVE-2026-115324

HIGH 8.1

mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

CWE	CWE-89
Vendor	mem0ai
Product	mem0
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for mem0ai mem0

Be the first to know when new high vulnerabilities affecting mem0ai mem0 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

mem0ai / mem0

0.1.117 < 1.0.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mem0ai/mem0/issues/4073 github.com: https://github.com/mem0ai/mem0/pull/4558 github.com: https://github.com/mem0ai/mem0/commit/a2ffca32660537b7b304305f36774ae2a13452cb github.com: https://github.com/mem0ai/mem0/releases/tag/v1.0.8 github.com: https://github.com/mem0ai/mem0/blob/v1.0.7/mem0/vector_stores/databricks.py github.com: https://github.com/mem0ai/mem0 vulncheck.com: https://www.vulncheck.com/advisories/mem0-0.1.117-before-1.0.8-sql-injection-via-databricks-vector-store

Credits

lighthousekeeper1212 (Lighthouse Research Project) 🔍 leediay153 from Viettel Post