Vulnerability Description
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/mem0ai/mem0
- https://github.com/mem0ai/mem0/blob/v1.0.7/mem0/vector_stores/databricks.py
- https://github.com/mem0ai/mem0/commit/a2ffca32660537b7b304305f36774ae2a13452cb
- https://github.com/mem0ai/mem0/issues/4073
- https://github.com/mem0ai/mem0/pull/4558
- https://github.com/mem0ai/mem0/releases/tag/v1.0.8
- https://www.vulncheck.com/advisories/mem0-0.1.117-before-1.0.8-sql-injection-via
FAQ
What is CVE-2026-115324?
CVE-2026-115324 is a vulnerability with a CVSS score of 8.1 (HIGH). mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply cra...
How severe is CVE-2026-115324?
CVE-2026-115324 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-115324?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.