mem0ai/mem0

chromadb 1.5.9

4 advisories.

How it can be abusedIf you run a Chroma database server alongside this project to store agent memories, an attacker who can reach that server over the network could run their own code on it, or read, change, or wipe any tenant's stored memories without proper authorization. This affects anyone self-hosting the stack with Chroma as the vector store; it does not affect users of other backends like Qdrant.

• highGHSA-2wm9-hf6c-p5crChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
• criticalGHSA-36p7-vc44-83pfChromaDB has a code injection vulnerability
• criticalGHSA-f4j7-r4q5-qw2cChromaDB Python project has a pre-authentication code injection vulnerability
• highGHSA-xph7-9rjv-w5frChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

litellm 1.83.7

5 advisories. Fixed in 1.84.0.

How it can be abusedThese are attacks against the LiteLLM proxy server itself, like tricking it with a fake host header or escalating your own user role to get keys for restricted routes. Mem0 only uses LiteLLM as a client library to call LLM providers and never runs that proxy server, so nobody deploying Mem0 is exposed.

• criticalGHSA-4xpc-pv4p-pm3wLiteLLM: Authentication Bypass via Host Header Injection
• highGHSA-7488-6r32-c95qLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
• highGHSA-qrc4-49gv-mv9mLiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
• highGHSA-wpfp-gwwc-vwq6LiteLLM allows a user to modify their own user_role via the /user/update endpoint
• highGHSA-wxxx-gvqv-xp7pLiteLLM has a sandbox escape in custom-code guardrail

aiohttp 3.13.5

1 advisory. Fixed in 3.14.3.

How it can be abusedThe Python SDK and self-hosted server use aiohttp to talk to LLM providers and vector stores, so they parse HTTP responses from outside services. A malicious or compromised endpoint, or anyone able to intercept that traffic, could send a malformed chunked response to crash the process or leak bits of memory, affecting anyone running the server or an agent using the library.

• highGHSA-cq5v-8q36-5273AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

azure-core 1.35.0

1 advisory. Fixed in 1.38.0.

How it can be abusedMem0 uses azure-core when talking to Azure AI services for LLM calls and embeddings, and the flaw lets maliciously crafted data received over the network be turned into running code. Anyone running Mem0 with Azure as their model or embedding provider could be at risk if an attacker can insert themselves between the app and the Azure endpoint, such as via a compromised network or a misconfigured custom service URL.

• highGHSA-jm66-cg57-jjv5Azure Core is vulnerable to deserialization of untrusted data

cryptography 45.0.5

4 advisories. Fixed in 48.0.1.

How it can be abusedAn attacker on the network could exploit flaws in the bundled crypto code to decrypt captured encrypted messages or stall certificate verification, but only if this project actually used those specific features like decrypting PKCS#7 envelopes or verifying unusual certificates. Here the library is only a background dependency for token and key handling in the self-hosted server's login layer, which does not use the vulnerable paths, so mainly self-hosted operators running that server are nominally exposed rather than SDK users.

• highGHSA-537c-gmf6-5ccfVulnerable OpenSSL included in cryptography wheels
• highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
• highGHSA-jwv3-5hgf-82wwpython-cryptography: Duplicate self-signed intermediates can cause exponential path-building
• highGHSA-r6ph-v2qm-q3c2cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

google-cloud-aiplatform 1.71.1

1 advisory. Fixed in 1.133.0.

How it can be abusedWhen this library runs Vertex AI jobs it can upload code and data to a Google Cloud Storage bucket whose name is guessed from your project number. An attacker who learns that name and creates the bucket first receives whatever the job uploads, which here could include memory text, embeddings, or credentials from anyone running mem0 with the Vertex AI option enabled.

• highGHSA-wh2j-26j7-9728Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming

httplib2 0.22.0

1 advisory. Fixed in 0.32.0.

How it can be abusedIf this library is used to fetch HTTP responses, a malicious or compromised server could reply with a tiny gzip file that expands to gigabytes when read, exhausting memory and crashing the process. In Mem0 the affected code would be anything making outbound calls through it, so operators running the self-hosted server or apps using the Python SDK could be knocked offline.

• highGHSA-j5g9-f88f-gfj3httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

langchain-core 0.3.86

1 advisory. Fixed in 1.2.22.

How it can be abusedThe flaw lives in old prompt-loading helpers that read files from disk based on a path they are given. An attacker who can control that path, for example by supplying a crafted prompt file to an app that loads user-submitted prompts, could trick the app into reading files outside the intended folder and leak secrets like API keys. In this repo the package is only pulled in for optional LangChain integrations and the vulnerable loaders are not used in the core memory pipeline, so mainly downstream apps that both depend on mem0's LangChain glue and load untrusted prompt files are exposed.

• highGHSA-qh6h-p6c9-ff54LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

langsmith 0.3.45

2 advisories. Fixed in 0.8.0.

How it can be abusedIf a developer enables the optional LangSmith tracing integration and pulls a prompt from the shared LangSmith hub, a malicious prompt manifest could run code or read files on their machine or on the self-hosted API server. This affects only users who opt into LangSmith; teams using default Qdrant storage without LangSmith are not exposed.

• highGHSA-3644-q5cj-c5c7LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
• highGHSA-f4xh-w4cj-qxq8LangSmith SDK TracingMiddleware: Arbitrary server-side file read

nltk 3.9.4

6 advisories. Fixed in 3.10.0.

How it can be abusedThese flaws let an attacker read arbitrary files on the server or crash it with crafted input, but only if the app loads NLTK corpora or data files using names or URLs that come from users. Mem0 does not use NLTK in its core memory pipeline, so only deployments that separately wire NLTK into user-facing code are exposed.

• highGHSA-6hm5-jgcp-p838Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
• highGHSA-fg7f-2386-8897Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
• highGHSA-m42h-3232-vpv3nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
• highGHSA-p4gq-832x-fm9vNatural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
• highGHSA-qvv7-cg9c-w4x3Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
• highGHSA-xh95-f55m-82fwNatural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

orjson 3.10.16

1 advisory. Fixed in 3.11.6.

How it can be abusedThe self-hosted FastAPI server uses orjson to parse incoming JSON request bodies. An attacker can send a request with thousands of nested brackets, which orjson does not guard against, crashing the worker process and taking down the memory API for everyone using that deployment.

• highGHSA-hx9q-6w63-j58vorjson does not limit recursion for deeply nested JSON documents

pillow 12.2.0

10 advisories. Fixed in 12.3.0.

How it can be abusedAn attacker who can submit an image to the self-hosted server, such as through the API when adding memories with attached screenshots or photos, could send a crafted file that exhausts memory and crashes the service, or in some cases corrupts memory while Pillow decodes it. Anyone running the self-hosted FastAPI server or processing untrusted images through the Python SDK is affected.

• highGHSA-45hq-cxwh-f6vcPillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
• highGHSA-5x94-69rx-g8h2Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
• highGHSA-62p4-gmf7-7g93Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
• highGHSA-6r8x-57c9-28j4Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
• highGHSA-8v84-f9pq-wr9xPillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
• highGHSA-9hw9-ch79-4vh6Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
• highGHSA-jjj6-mw9f-p565Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
• highGHSA-phj9-mv4w-65pmPillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
• highGHSA-vjc4-5qp5-m44jPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
• highGHSA-xj96-63gp-2gmrPillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

pyasn1 0.6.1

5 advisories. Fixed in 0.6.2.

How it can be abusedAn attacker who can send crafted encoded data to anything in this project that decodes it with pyasn1 could hang the process with tiny malicious inputs, since the decoder chokes on certain values and burns CPU indefinitely. In practice this mostly matters for the self-hosted server and any deployment that parses such data; the core SDK does not decode ASN.1 itself, so most users are only exposed if a dependency pulls pyasn1 in.

• highGHSA-63vm-454h-vhhqpyasn1 has a DoS vulnerability in decoder
• highGHSA-8ppf-4f7h-5ppjpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
• highGHSA-hm4w-wwcw-mr6rpyasn1: Uncontrolled resource consumption when converting decoded REAL values
• highGHSA-jr27-m4p2-rc6rDenial of Service in pyasn1 via Unbounded Recursion
• highGHSA-m4p7-r5rc-7g4jpyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

pyjwt 2.12.1

1 advisory. Fixed in 2.13.0.

How it can be abusedAnyone running the self-hosted REST API server relies on PyJWT to verify login tokens. If the server were set up to accept both symmetric secrets and public keys when checking tokens, an attacker who knows a public key could sign their own fake access token and get in as any user without knowing the real secret.

• highGHSA-xgmm-8j9v-c9wxPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

setuptools 78.1.0

1 advisory. Fixed in 78.1.1.

How it can be abusedThis flaw lives in setuptools' old package-download code, which is only used when installing packages from custom URLs. An attacker would need to trick a developer or CI job into installing a malicious package URL during setup, letting them write files anywhere on the machine. Since Mem0 uses setuptools only as a build tool and never downloads packages this way at runtime, real-world exposure is minimal.

• highGHSA-5rjg-fvgr-3xxfsetuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

transformers 5.3.0

1 advisory. Fixed in 5.5.0.

How it can be abusedAn attacker who can get a victim to load a maliciously crafted LightGlue vision model file could have arbitrary code run on that machine. This only matters if the project actually loads such models locally, which a memory-layer SDK like this one does not do in its normal operation.

• highGHSA-fgcw-684q-jj6rhuggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path

ujson 5.12.0

1 advisory. Fixed in 5.12.1.

How it can be abusedIf the server or SDK serializes data with ujson and a write fails partway through, memory is leaked each time, so an attacker who can repeatedly cause failed writes could slowly exhaust server memory and crash it. This mainly affects anyone running the self-hosted FastAPI server; the core Python and TypeScript libraries barely use ujson at all.

• highGHSA-c38f-wx89-p2xgUltraJSON has a Memory Leak in ujson.dump() on Write Failure

urllib3 2.3.0

4 advisories. Fixed in 2.6.0.

How it can be abusedAny code path that fetches from an HTTP endpoint using this library, such as the self-hosted server calling out to LLM providers or the Python SDK talking to the hosted platform, can be tricked by a malicious or compromised remote server into downloading huge amounts of data disguised as highly compressed redirects, exhausting memory and hanging the process. This affects anyone running the FastAPI server, the Python CLI, or apps built on mem0ai that make outbound HTTP requests.

• highGHSA-2xpw-w6gg-jr37urllib3 streaming API improperly handles highly compressed data
• highGHSA-38jv-5279-wg99Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
• highGHSA-gm62-xv2j-4w53urllib3 allows an unbounded number of links in the decompression chain
• highGHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects