8.1
HighCVSS 3.1 · from VulnCheck
CVE-2026-115324
mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
mem0 · SQL injection · CWE-89Affectedmem0
FixUpdate to 1.0.8 or newer
PublishedOct 22, 10:57 · VulnCheck
ScoredOct 22 · 8.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inmem00.1.117 – before 1.0.81.0.8mem0Not affected1.0.8
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known