mem0ai Mem0 up to 2.0.17 Session Scope mem0/memory/main.py _build_session_scope user_id command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in mem0ai Mem0 up to 2.0.17. Affected by this vulnerability is the function _build_session_scope of the file mem0/memory/main.py of the component Session Scope. The manipulation of the argument user_id results in command injection. This vulnerability is cataloged as CVE-2026-116575. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in mem0ai Mem0 up to 2.0.17. It has been classified as critical. Affected is the function _build_session_scope of the file mem0/memory/main.py of the component Session Scope. The manipulation of the argument user_id with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-116575 since 10/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.0.18 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• mem0ai

Name

• Mem0

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17

Website

• Product: https://github.com/mem0ai/mem0/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion