What happened
Mem0 (persistent memory for AI agents) had a session-scope construction flaw (published 2026-10-26, CVSS 6.3). Caller-controlled user_id, agent_id and run_id values are joined into the session scope string without proper escaping/parameterization, introducing an SQL-injection-style weakness in the memory query path. Fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Why it matters
Mem0 is agent memory: it stores and retrieves the context that shapes an agent's decisions. SQL injection into the memory store lets an attacker manipulate, exfiltrate, or corrupt another agent/user's memory — a memory-poisoning vector that can alter future agent behavior across sessions.
Attack vector
_build_session_scope() (Python) / Memory.buildSessionScope() (TS) concatenate caller-controlled user_id, agent_id and run_id values into a session scope string without safe separation/parameterization, enabling SQL injection in the underlying memory query. An attacker-supplied identifier can alter the query scope.
Affected systems
mem0 Python SDK < 2.0.18; mem0 TypeScript SDK < 3.1.6 (fixed in commit 71f2ebefa3494da21550fb525216818776cde67f)
Mitigation
Upgrade to mem0 Python SDK 2.0.18+ / TypeScript SDK 3.1.6+; validate or parameterize user_id/agent_id/run_id before building session scope.