Skip to content
OpenAdvisories

Package · Maven

org.springframework.data:spring-data-mongodb

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.1
    CVE-2026-41717

    Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

    Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affecte…

    Spring Spring Data MongoDB org.springframework.data:spring-data-mongodb Maven
  • Medium 5.9
    CVE-2026-41696

    Spring Data MongoDB Bind Parameter Literal Quoting Breakout

    Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affect…

    Spring Spring Data MongoDB org.springframework.data:spring-data-mongodb Maven
  • Critical 9.0
    CVE-2022-22980 Public exploit EPSS 18%

    SpEL Injection in Spring Data MongoDB

    A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.

    org.springframework.data:spring-data-mongodb Maven