~ / search / GHSA-fvh3-672c-7p6c

GHSA-fvh3-672c-7p6c

Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-22738

Packages

EcosystemPackageAffectedFixed in
Maven org.springframework.ai:spring-ai-vector-store >= 1.0.0, < 1.0.5 1.0.5
Maven org.springframework.ai:spring-ai-vector-store >= 1.1.0-M1, < 1.1.4 1.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

References

External links from the advisory. They lead to third-party sites.