Low (AgentArmorHQ estimate)Command injectionJune 5, 2026

claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision

Product: claude-mem
CVE: CVE-2026-11330
Affected: claude-mem < 12.0.0
Fixed in: 12.0.0

Last verified against sources: October 26, 2026

Am I affected?

claude-mem: affected claude-mem < 12.0.0. Fixed in 12.0.0.

Check your version: run npm ls claude-mem. Versions < 12.0.0 of claude-mem are affected. [1]

What to do now

Upgrade to the fixed version: run npm install claude-mem@12.0.0 (first patched version 12.0.0). [1]
Upgrade to version 12.0.0. [1]

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

Discuss this incident

What happened

A weakness has been identified in thedotmack claude-mem up to 11.0.1. [1]
The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. [1]

Impact

This manipulation causes use of weak hash. [1]
The attack can only be executed locally. [1]
The attack's complexity is rated as high. [1]
The exploitability is described as difficult. [1]

What was done

Upgrading to version 12.0.0 is sufficient to fix this issue. [1]
Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. [1]
It is suggested to upgrade the affected component. [1]

Sources

GHSA-5gvr-v6qv-h5mm — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Copy a plain-text summary for Slack, GitHub issues, or team security channels.

Brief

[CVE-2026-11330] claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision
Product: claude-mem | Affected: claude-mem < 12.0.0 | Fixed in: 12.0.0
Summary: A weakness has been identified in thedotmack claude-mem up to 11.0.1.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/06/cve-2026-11330-claude-mem

Was this page useful?

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

Discussions for CVE-2026-11330

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

← All incidents Related tools in directory Check package