fix: remove unsafe eval() in main.py

[orbisai0security]

Summary

Fix critical severity security issue in mem0/memory/main.py.

Vulnerability

Field	Value
ID	V-004
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-004
File	mem0/memory/main.py:417

Description: The memory search and retrieval operations in mem0/memory/main.py accept user_id, agent_id, and run_id as filter parameters directly from the client request without verifying that the authenticated user is authorized to access the specified user_id. This is a classic Insecure Direct Object Reference (IDOR) vulnerability: any authenticated user can substitute any other user's ID to retrieve their private memories. The same pattern appears at lines 417, 471, 707, and 1463.

Changes

• mem0/memory/main.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security