mem0 EUVD-2026-108126

The deployment must be running mem0 (versions 0.1.117 up to but not including 1.0.8) configured to use the Databricks vector store backend (mem0/vector_stores/databricks.py) - this is a non-default backend choice and is the central prerequisite. The attacker must be able to influence stored memory content, specifically memory text, metadata values, or message names, which flow into the unescaped insert() and update() string interpolation. Limiting factors beyond the Databricks backend requirement: the CVSS AC:H/AT:P indicates exploitation is not deterministic, consistent with attacker text passing through mem0's memory-ingestion pipeline before storage; the exact trigger mechanics for reliably preserving a payload through that pipeline are not detailed in the available sources. The complete fix is upgrading to v1.0.8; the vendor diff provides no alternative mitigation.

The CVSS 4.0 base score of 9.2 (Critical) reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) on the backing Databricks SQL warehouse via network-reachable, unauthenticated input (AV:N/PR:N/UI:N). However, the same vector carries AC:H and AT:P, signalling that successful exploitation is not trivial and depends on specific attack requirements - consistent with the fact that the vulnerable code path exists only when mem0 is configured to use the Databricks vector store backend, and that attacker-supplied text is ingested through mem0's memory pipeline rather than written verbatim. The vuln.today Decision label is 'act_now', which should drive prioritization for anyone actually running the Databricks backend. Countervailing signals: no EPSS score is provided in the input, there is no CISA KEV listing, and no verified working exploit is referenced - so there is no evidence of active or widespread exploitation at this time. Net: a genuine high-priority issue for the specific population running mem0 with Databricks, but not demonstrably under active exploitation; organizations not using the Databricks vector store are not exposed to this code path. No EPSS value was supplied, so exploitation probability cannot be compared against the KEV/Decision signals.

An attacker interacts with an AI application that uses mem0 with the Databricks vector store and submits crafted content - memory text, metadata, or a message name - containing a SQL payload. When mem0 stores the memory, the payload reaches unescaped string interpolation in insert()/update() in databricks.py and executes as SQL against the configured Databricks SQL warehouse. No verified public exploit is referenced in the input, though the fixing PR and a GitHub issue describe the flaw.