p PatchFirst

CVE-2026-115324

CVE-2026-115324 · mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store

This page contains facts from public vulnerability sources. Check the original advisory before updating.

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

CVSS 9.2 · Critical · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • mem0

    Versions
    • ≥ 0.1.117, < 1.0.8: Affected (semver)
    • 1.0.8: Not affected (semver)

    Update to 1.0.8

  • mem0ai PyPI

    Versions
    • 0.1.117
    • 0.1.118
    • 1.0.0
    • 1.0.0b0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    Affected ranges
    • ECOSYSTEM: ≥ 0.1.117, < 1.0.8

    Update to 1.0.8

Original sources

Check your server →