{"id":"EUVD-2026-110315","enisaUuid":"b99be5b1-1c91-347a-8e7e-134ead27cc49","description":"Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped \u0026 and \u003d delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant\u0027s history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.","datePublished":"Oct 26, 2026, 8:15:01 PM","dateUpdated":"Oct 27, 2026, 2:18:25 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/mem0ai/mem0/security/advisories/GHSA-5324-3w58-qpp2\nhttps://github.com/mem0ai/mem0/pull/6892\nhttps://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f\nhttps://github.com/mem0ai/mem0/releases/tag/ts-v3.1.6\nhttps://github.com/mem0ai/mem0/releases/tag/v2.0.18\n","aliases":"CVE-2026-116575\n","assigner":"GitHub_M","epss":0.11,"enisaIdProduct":[{"id":"1ccf6108-bdec-3829-a5f1-47018ebcb46c","product":{"name":"mem0","vendor":{"name":"mem0ai"}},"product_version":"\u003c 2.0.18"}],"enisaIdVendor":[{"id":"3c0a42a5-d7ea-34c9-9fd8-02b19277d0fa","vendor":{"name":"mem0ai"}}],"enisaIdVulnerability":[{"id":"68aa4806-ea7a-3fa5-b0e2-c5dea3f05249","vulnerability":{"id":"CVE-2026-116575","description":"Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped \u0026 and \u003d delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant\u0027s history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.","datePublished":"Oct 26, 2026, 8:15:01 PM","dateUpdated":"Oct 27, 2026, 2:18:25 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/mem0ai/mem0/security/advisories/GHSA-5324-3w58-qpp2\nhttps://github.com/mem0ai/mem0/pull/6892\nhttps://github.com/mem0ai/mem0/commit/71f2ebefa3494da21550fb525216818776cde67f\nhttps://github.com/mem0ai/mem0/releases/tag/ts-v3.1.6\nhttps://github.com/mem0ai/mem0/releases/tag/v2.0.18\n","enisa_id":"EUVD-2026-110315\n","assigner":"GitHub_M","epss":0.11,"dataProcessed":"Oct 28, 2026, 11:00:43 PM","vulnerabilityProduct":[{"id":"70e4db28-daf2-3d2d-8230-cd7e8cfbcb33","product":{"name":"mem0","vendor":{"name":"mem0ai"}},"product_version":"\u003c 2.0.18"}],"vulnerabilityVendor":[{"id":"84b9b3e7-84a0-321c-a985-e4856cf1e389","vendor":{"name":"mem0ai"}}]}}],"enisaIdAdvisory":[]}