6.3
MediumCVSS 3.1 · from VulDB
CVE-2026-7597
mem0ai mem0 faiss.py pickle.dump deserialization
mem0 · Unsafe deserialization · CWE-502Affectedmem0
FixA patch is linked in the references.
PublishedMay 1, 21:15 · VulDB
ScoredMay 1 · 6.3 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector_stores/faiss.py. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 62dca096f9236010ca15fea9ba369ba740b86b7a. Applying a patch is the recommended action to fix this issue.
From VulDB
Affected and fixed versions
ProductAffectedFixed inmem01.0.0–mem01.0.1–mem01.0.2–mem01.0.3–mem01.0.4–mem01.0.5–mem01.0.6–mem01.0.7–mem01.0.8–mem01.0.9–mem01.0.10–mem01.0.11–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known