Skip to content
OpenAdvisories

Package · Maven

org.springframework.ai:spring-ai-vector-store

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.6
    CVE-2026-40967

    Spring AI has a VectorStore FilterExpression Converter injection

    In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the quer…

    Spring Spring AI org.springframework.ai:spring-ai-vector-store Maven
  • Critical 9.8
    CVE-2026-22738 Public exploit

    SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

    In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-…

    Spring Spring AI org.springframework.ai:spring-ai-vector-store Maven
  • High 8.6
    CVE-2026-22729

    CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

    A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated…

    VMware Spring AI org.springframework.ai:spring-ai-vector-store Maven