Description
A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.
Published: 2026-06-05
Score: 2 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability involves the use of a weak hash algorithm in the Observation Content Hash Handler of thedotmack claude-mem. An attacker who can execute code locally can manipulate or predict the hash values, potentially enabling undetected tampering or misuse of observation data. The weakness is tied to the computeObservationContentHash function and is classified under CWE-327 and CWE-328.

Affected Systems

The affected application is claude-mem version 11.0.1 or earlier, developed by thedotmack. The specific component impacted is the Observation Content Hash Handler located in src/services/sqlite/observations/store.ts. Upgrading to version 12.0.0 or later resolves the issue.

Risk and Exploitability

The CVSS score is 2, indicating low overall severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack can only be performed locally, has a high complexity rating, and is described as difficult to exploit. Therefore, the risk is considered low, but local execution privileges should still be restricted.

Generated by OpenCVE AI on June 5, 2026 at 15:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the claude-mem component to version 12.0.0 or later.
  • If upgrade is not immediately possible, disable or restrict local execution of the Observation Content Hash Handler so only trusted processes can access it.
  • Modify the computeObservationContentHash function to replace the weak hash algorithm with a secure hash such as SHA‑256 or higher.

Generated by OpenCVE AI on June 5, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 05 Jun 2026 13:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.
Title thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash
First Time appeared Thedotmack
Thedotmack claude-mem
Weaknesses CWE-327
CWE-328
CPEs cpe:2.3:a:thedotmack:claude-mem:*:*:*:*:*:*:*:*
Vendors & Products Thedotmack
Thedotmack claude-mem
References
Metrics cvssV2_0

{'score': 2.4, 'vector': 'AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.6, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Thedotmack Claude-mem
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-05T12:45:12.204Z

Reserved: 2026-06-05T06:56:10.993Z

Link: CVE-2026-11330

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-06-05T14:16:35.457

Modified: 2026-06-05T14:59:31.207

Link: CVE-2026-11330

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T15:15:27Z

Weaknesses