CVE-2026-11330: Weak Cryptographic Hash in thedotmack claude-mem—Patch to 12.0.0

Technical summary

CVE-2026-11330 involves the computeObservationContentHash function in src/services/sqlite/observations/store.ts, which employs a weak cryptographic hash for content verification. The vulnerability is constrained to local attack scenarios (AV:L), requires user-level privileges (PR:L), and has high complexity (AC:H), making opportunistic exploitation unlikely. The weakness falls under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-328 (Use of Insufficiently Random Values), indicating both algorithm choice and potential entropy issues. Version 12.0.0 introduces a cryptographically sound replacement, referenced by commit f32fda8b35e9fe9329f87da65c31149362a03f97.

Business impact

The integrity risk posed by weak hashing is situational. If observation data feeds downstream compliance or audit workflows, compromised hashes could undermine chain-of-custody claims or allow undetected tampering of records. However, the local-only attack surface and requirement for user credentials significantly reduce real-world risk in typical deployments. Organizations relying on claude-mem for data integrity guarantees should prioritize patching; those using it for non-critical observation logging may defer.

Affected systems

thedotmack claude-mem versions 11.0.1 and earlier are vulnerable. Version 12.0.0 and later contain the fix. No CVSS analysis was available for broader product ecosystems; the vulnerability is specific to this component's hash implementation.

Exploitability

Exploitation requires local system access and at least standard user privileges—a relatively high bar in most enterprise environments. The attack complexity rating of high reflects the need for specific preconditions and technical knowledge to craft meaningful hash collisions or forgeries. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploit tooling is known to exist, further reducing practical risk.

Remediation

Upgrade thedotmack claude-mem to version 12.0.0 or later. The patch replaces the weak hashing implementation with a stronger cryptographic function. No configuration changes or compensating controls are documented as necessary; patching is the definitive remediation.

Patch guidance

Apply version 12.0.0 as soon as practical, prioritizing systems where observation data integrity is mission-critical or subject to regulatory verification. Standard change-control processes suffice; no special pre-patch validation is required. Verify the patched binary or commit hash against vendor releases to confirm authenticity. Organizations on extended support should check vendor lifecycle policies, as version 12.0.0 may carry long-term support designation.

Detection guidance

Monitor file integrity or log access to src/services/sqlite/observations/store.ts in running instances. Establish baseline behavior for the computeObservationContentHash function using application performance monitoring (APM) tools. Hash collision or manipulation attempts are difficult to detect post-exploitation but may produce anomalies in observation audit trails. Implement change management controls to flag unexpected hash computation behavior or mismatches between stored and recalculated values.

Why prioritize this

Despite a CVSS score of 3.6 (LOW), this vulnerability warrants timely attention due to the integrity risk it poses to data workflows. It should not block other operational priorities but should be scheduled for the next routine patching cycle. Organizations with strict data integrity requirements or compliance obligations tied to hash verification should elevate priority.

Risk score, explained

The CVSS 3.1 score of 3.6 reflects the confluence of local-only access (reducing attack surface), high complexity (reducing likelihood), and limited impact (no confidentiality loss, partial integrity and availability impact). The score appropriately downgrades the risk despite the cryptographic nature of the flaw, as the prerequisites for successful exploitation are demanding.

Frequently asked questions