Mem0 provides persistent memory infrastructure for AI agents and applications.

Summary buildsessionscope() in mem0/memory/main.py builds the conversation-history scope key used to fetch/store the last N raw messages by naively joining caller-supplied userid/agentid/runid values with unescaped & and = delimiters: def buildsessionscope(filters): parts = [] for key in sorted(["userid", "agentid", "runid"]): val = filters.get(key) if val: parts.append(f"{key}={val}") return "&".join(parts) validateandtrimentityid() (the only validation applied to these values) rejects only empty/whitespace-only strings — it never forbids & or =. This scope string is then used as an exact-match key against a SQLite column (storage.py: WHERE sessionscope = ?) to fetch the last 10 raw messages for a given scope (main.py, Phase 0 of addtovectorstore, both sync and async). Impact Any caller who controls only their own runid (or agentid) — a very common integration shape, since apps frequently pass a client-/session-supplied identifier straight through as runid without namespacing — can craft a value containing &userid= (or &agentid= ) that produces a scope string byte-for-byte identical to a different tenant's real scope string. Concretely: Tenant A calls add(msgs, userid="alice",…

curl https://cve.zerocrew.in/api/cve/CVE-2026-116575