GitHub Advisoryadvisory · Maven

GHSA-qc4j-qjqx-vr58 Spring AI has a VectorStore FilterExpression Converter injection

HIGH Published 2026-04-28 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-40967
Ecosystem
Maven
Packages
org.springframework.ai:spring-ai-vector-store
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-94
Reviewed
2026-05-06

Affected packages

• Maven org.springframework.ai:spring-ai-vector-store: >= 1.0.0, < 1.0.6 → fixed in 1.0.6 • Maven org.springframework.ai:spring-ai-vector-store: >= 1.1.0, < 1.1.5 → fixed in 1.1.5

Description

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Related

Alias · CVE (1)

  • CVE-2026-40967 In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References