Skip to content
OpenAdvisories

Product · Spring

Spring AI

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-22738 Public exploit

    SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

    In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-…

    Spring Spring AI org.springframework.ai:spring-ai-vector-store Maven