TI-2026-09779 Aliases CVE-2026-11330 GHSA-5gvr-v6qv-h5mm

thedotmack claude-mem Observation Content Hash store.ts computeObservationContentHash weak hash

LOW 9CWE-327Published 2026-06-05 · Updated 2026-06-08

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00075 0th percentileScored 2026-11-07

Fix Fixed claude-mem (thedotmack): 12.0.0claude-mem (npm): 12.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
thedotmack	claude-mem	11.0.0; 11.0.1	12.0.0	Patch available	CNA
—	claude-mem (npm)	before 12.0.0	12.0.0	Patch available	GHSA-5gvr-v6qv-h5mm

claude-mem Vendorthedotmack Affected 11.0.0; 11.0.1 Fixed in 12.0.0 Patch available CNA
claude-mem (npm) Vendor— Affected before 12.0.0 Fixed in 12.0.0 Patch available GHSA-5gvr-v6qv-h5mm

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thedotmack:claude-mem::::::::	—	—	thedotmack

cpe:2.3:a:thedotmack:claude-mem:*:*:*:*:*:*:*:* Versions — — ·thedotmack

Remediation

Fix · CNA claude-mem (thedotmack) Fixed in 12.0.0
Fix · GHSA-5gvr-v6qv-h5mm claude-mem (npm) Fixed in 12.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-11330
2026-10-03 Alias added: GHSA-5gvr-v6qv-h5mm

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-11330

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences