Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mem0ai/mem0

              main @ 5d573dd
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

mem0/vector_stores/mongodb.py: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Broken Access Control: The REST API endpoint for memory management entirely lacks authentication and authorization checks, allowing unauthenticated remote attackers to inject, read, delete, or reset memory databases. This is documented under multiple CVEs.

SQL Injection: The PostgreSQL vector store was vulnerable to SQL injection due to dynamic construction of SQL queries using unsanitized table, database, and filter key identifiers. Fixing this required strict identifier validation and escaping.

NoSQL Injection: Unsanitized client-supplied filter parameters passed into MongoDB queries allowed attackers to inject MongoDB operators (e.g., dict objects) to bypass query constraints.