Log in Start free

Vulnerability · Published Jun 5, 2026 · Assigned by VulDB

CVE-2026-11330thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash

Low 3.6

In plain English

A low-severity broken cryptography in claude-mem from thedotmack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)<0.1%top 99.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmclaude-mem12.0.0GHSA-5gvr-v6qv-h5mm

Affected products (as reported)

VendorProductVersions
thedotmack claude-mem 11.0.011.0.1

Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C

References