Threats affecting pkg:npm/mem0

CVE-2026-116575 is a vulnerability in mem0, a persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, the session scope key generation improperly concatenates user-controlled identifiers without escaping delimiters, allowing cross-tenant session key collisions. This flaw enables unauthorized access to other tenants' conversation histories, leading to exposure and potential interleaving of sensitive information. The issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.