---
id: CVE-2026-115324
title: mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
summary: >-
  mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in
  mem0/vector_stores/databricks.py that allows attackers to inject SQL by
  influencing stored memory content. Attackers can supply crafted memory text,
  metadata, or messag…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: mem0ai
product: mem0
affected:
  - mem0 >= 0.1.117 < 1.0.8
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:43.136Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115324'
references:
  - url: 'https://github.com/mem0ai/mem0/issues/4073'
  - url: 'https://github.com/mem0ai/mem0/pull/4558'
  - url: >-
      https://github.com/mem0ai/mem0/commit/a2ffca32660537b7b304305f36774ae2a13452cb
  - url: 'https://github.com/mem0ai/mem0/releases/tag/v1.0.8'
    label: v1.0.8 Release Notes
  - url: >-
      https://github.com/mem0ai/mem0/blob/v1.0.7/mem0/vector_stores/databricks.py
  - url: 'https://github.com/mem0ai/mem0'
  - url: >-
      https://www.vulncheck.com/advisories/mem0-0.1.117-before-1.0.8-sql-injection-via-databricks-vector-store
    label: >-
      VulnCheck Advisory: mem0 0.1.117 before 1.0.8 SQL Injection via Databricks
      Vector Store
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.334Z'
---

## Overview

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

## Affected

- `mem0 >= 0.1.117 < 1.0.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.