{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-115324",
    "url": "https://cveboard.org/i/cve-2026-115324",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-115324",
    "json": "https://cveboard.org/i/cve-2026-115324.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "mem0ai Databricks vector store vulnerable to SQL injection",
    "summary": "mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.",
    "titlePt": "mem0ai Databricks vector store vulnerável a injeção de SQL",
    "summaryPt": "mem0 0.1.117 antes de 1.0.8 contém uma vulnerabilidade de injeção de SQL em mem0/vector_stores/databricks.py que permite que atacantes injetem SQL influenciando o conteúdo da memória armazenada. Atacantes podem fornecer texto de memória, metadados ou nomes de mensagens elaborados que alcançam a interpolação de strings insert() e update() não escapadas para executar SQL injetado no Databricks SQL warehouse configurado.",
    "affected": [],
    "omitted": 0,
    "references": [],
    "cwes": [],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "pip"
    ],
    "cves": [
      "CVE-2026-115324"
    ],
    "ghsa": "GHSA-7587-9684-52r6",
    "cvss": {
      "score": 9.2,
      "version": "4.0",
      "by": "GitHub"
    },
    "epss": {
      "percentage": 0.00326,
      "percentile": 0.24489,
      "asOf": "2026-10-23",
      "by": "FIRST"
    },
    "packages": [
      {
        "ecosystem": "pip",
        "name": "mem0ai",
        "vulnerable": ">= 0.1.117, < 1.0.8",
        "fixed": "1.0.8",
        "advisory": "GHSA-7587-9684-52r6"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-7587-9684-52r6"
      }
    ],
    "cvePending": false,
    "publishedAt": "2026-10-22T12:31:17.000Z",
    "updatedAt": "2026-10-22T12:31:17.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-7587-9684-52r6:ghsa_published:2026-10-22T12:31:17.000Z",
      "incidentId": "cve-2026-115324",
      "type": "ghsa_published",
      "at": "2026-10-22T12:31:17.000Z",
      "detail": {
        "ghsa": "GHSA-7587-9684-52r6",
        "severity": "critical",
        "fixed": "1.0.8"
      }
    }
  ]
}