GHSA-c267-rfvc-mvpm
SQL Injection in Spring AI MariaDBFilterExpressionConverter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.ai:spring-ai-mariadb-store | >= 1.1.0-M1, < 1.1.3 | 1.1.3 |
| Maven | org.springframework.ai:spring-ai-mariadb-store | < 1.0.4 | 1.0.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.
The vulnerability exists due to missing input sanitization.
References
External links from the advisory. They lead to third-party sites.