CVE-2026-11330

thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash

View on CVE.org
Published Jun 5, 2026 CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Description
A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.

Analysis

AI-generated

Technical impact

The vulnerability involves the use of a weak hash algorithm in the Observation Content Hash Handler of thedotmack claude-mem. An attacker who can execute code locally can manipulate or predict the hash values, potentially enabling undetected tampering or misuse of observation data. The weakness is tied to the computeObservationContentHash function and is classified under CWE-327 and CWE-328.

Affected Systems

The affected application is claude-mem version 11.0.1 or earlier, developed by thedotmack. The specific component impacted is the Observation Content Hash Handler located in src/services/sqlite/observations/store.ts. Upgrading to version 12.0.0 or later resolves the issue.

Risk and Exploitability

The CVSS score is 2, indicating low overall severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack can only be performed locally, has a high complexity rating, and is described as difficult to exploit. Therefore, the risk is considered low, but local execution privileges should still be restricted.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the claude-mem component to version 12.0.0 or later.
  • If upgrade is not immediately possible, disable or restrict local execution of the Observation Content Hash Handler so only trusted processes can access it.
  • Modify the computeObservationContentHash function to replace the weak hash algorithm with a secure hash such as SHA‑256 or higher.

Generated by OpenCVE AI on June 5, 2026 at 15:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-5gvr-v6qv-h5mm claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.
Title thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash
First Time appeared Thedotmack
Thedotmack claude-mem
Weaknesses CWE-327
CWE-328
CPEs cpe:2.3:a:thedotmack:claude-mem:*:*:*:*:*:*:*:*
Vendors & Products Thedotmack
Thedotmack claude-mem
References
Metrics cvssV2_0

{'score': 2.4, 'vector': 'AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.6, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm

  • CWE-328

    Use of Weak Hash

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jun 8, 2026, 4:04 PM
Reserved
Jun 5, 2026, 6:56 AM

View source JSON

Updated
Jun 8, 2026, 4:04 PM

JSON

Status
Deferred
Published
Jun 5, 2026, 2:16 PM
Modified
Oct 26, 2026, 11:10 AM

View source JSON

No data.

Updated
Jun 7, 2026, 11:16 AM

JSON