GHSA-v6x6-pjxw-3pv2
Spring AI's VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.springframework.ai:spring-ai-advisors-vector-store | >= 1.0.0, < 1.0.6 | 1.0.6 |
| Maven | org.springframework.ai:spring-ai-advisors-vector-store | >= 1.1.0, < 1.1.5 | 1.1.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
References
External links from the advisory. They lead to third-party sites.