Spring AI

4 results · Clear filters · Feed

• High 8.2
  CVE-2026-41713

  Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

  A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across co…

  VMware Spring AI org.springframework.ai:spring-ai-client-chat Maven
  May 12, 2026
• High 7.5
  CVE-2026-41712

  ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

  Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

  VMware Spring AI org.springframework.ai:spring-ai-client-chat org.springframework.ai:spring-ai-advisors-vector-store Maven
  May 12, 2026
• High 8.6
  CVE-2026-22729

  CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

  A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated…

  VMware Spring AI org.springframework.ai:spring-ai-vector-store Maven
  Mar 18, 2026
• High 8.8
  CVE-2026-22730 Public exploit

  CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

  A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

  VMware Spring AI org.springframework.ai:spring-ai-mariadb-store Maven
  Mar 18, 2026