Critical SQL Injection Flaw Found in mem0 Vector Store Library

The National Vulnerability Database has published details for CVE-2026-115324, a critical security flaw in the mem0 library. The vulnerability allows for SQL injection attacks against systems using the library’s integration with Databricks SQL warehouses. This issue stems from how the software handles user-supplied data when interacting with the database backend.

According to the NVD record, the weakness exists in the mem0/vector_stores/databricks.py module. Attackers can exploit this by supplying crafted memory text, metadata, or message names. These inputs reach unescaped string interpolation points in insert and update operations. Consequently, an attacker can execute arbitrary SQL commands on the configured Databricks warehouse.

Technical Context and Severity

The National Vulnerability Database assigns a CVSS score of 9.2 to this vulnerability, categorizing it as critical. The flaw maps to CWE-89, which identifies SQL injection as the underlying weakness. The risk arises because the application fails to properly sanitize or parameterize inputs before sending them to the database.

The specific code path affected involves the Databricks vector store implementation. When the library processes stored memory content, it constructs SQL queries using string interpolation. If an attacker can influence the content of the stored memory, they can inject malicious SQL syntax. This bypasses standard input validation and allows direct interaction with the database engine.

Who Is Affected

The vulnerability affects users of the mem0 library developed by mem0ai. Specifically, any installation running a version before 1.0.8 is considered affected. Organizations that rely on mem0 for memory management in AI applications, particularly those using Databricks as a backend, are at risk.

The impact depends on whether an attacker can influence the stored memory content. If the application allows external users to submit data that becomes part of the stored memory, the risk of exploitation increases. Internal applications with strict input controls may have lower exposure, but the underlying code remains vulnerable.

What should you do?

Security teams should immediately audit their use of the mem0 library. Identify all instances where the library interacts with Databricks SQL warehouses. Review the version of mem0 currently deployed in production and development environments.

If you are running a version prior to 1.0.8, you should assess the risk of external input reaching the memory storage functions. Implement additional input validation at the application layer to restrict characters that could be used for SQL injection. Monitor database logs for unusual query patterns that might indicate exploitation attempts.