~ / search / GHSA-cmwh-w62w-r2mf

GHSA-cmwh-w62w-r2mf

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

Source: GitHub Advisory Database (reviewed) High CVE-2026-47835

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.ai:spring-ai-opensearch-store >= 1.0.0, < 1.0.9 1.0.9
Maven org.springframework.ai:spring-ai-opensearch-store >= 1.1.0, < 1.1.8 1.1.8
Maven org.springframework.ai:spring-ai-elasticsearch-store >= 1.0.0, < 1.0.9 1.0.9
Maven org.springframework.ai:spring-ai-elasticsearch-store >= 1.1.0, < 1.1.8 1.1.8
Maven org.springframework.ai:spring-ai-gemfire-store >= 1.0.0, < 1.0.9 1.0.9
Maven org.springframework.ai:spring-ai-gemfire-store >= 1.1.0, < 1.1.8 1.1.8

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

References

External links from the advisory. They lead to third-party sites.