Low 3.6Published Jun 5, 2026

CVE-2026-11330thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash

Updated under an hour ago (Oct 27, 2026, 2:00 AM ET)

Does this affect you?

It affects thedotmack claude-mem. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for thedotmack claude-mem

Exploited in the last 30 days

A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.

CVSS: 3.6 LOW (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
Weakness (CWE): CWE-328, CWE-327
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Jun 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

thedotmack claude-mem thedotmack:claude-mem	11.0.0; 11.0.1; 12.0.0 not affected	CNA record

References

References

https://vuldb.com/vuln/368870	vdb-entry, technical-description
https://vuldb.com/vuln/368870/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-11330	third-party-advisory
https://vuldb.com/submit/832401	third-party-advisory
https://github.com/thedotmack/claude-mem/pull/1494	issue-tracking, patch
https://github.com/thedotmack/claude-mem/commit/f32fda8b35e9fe9329f87da65c31149362a03f97	patch
https://github.com/thedotmack/claude-mem/releases/tag/v12.0.0	patch
https://github.com/thedotmack/claude-mem/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.