Description
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.
Affected versions:
Spring AI 1.0.0 through 1.0.x (fix 1.0.9).
Spring AI 1.1.0 through 1.1.x (fix 1.1.8).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring AI | 1.0.0 – < 1.0.9, 1.1.0 – < 1.1.8 | 1.0.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.ai:spring-ai-elasticsearch-store | >= 1.0.0, < 1.0.9 | 1.0.9 | GHSA-cmwh-w62w-r2mf |
| Maven | org.springframework.ai:spring-ai-elasticsearch-store | >= 1.1.0, < 1.1.8 | 1.1.8 | GHSA-cmwh-w62w-r2mf |
| Maven | org.springframework.ai:spring-ai-gemfire-store | >= 1.0.0, < 1.0.9 | 1.0.9 | GHSA-cmwh-w62w-r2mf |
| Maven | org.springframework.ai:spring-ai-gemfire-store | >= 1.1.0, < 1.1.8 | 1.1.8 | GHSA-cmwh-w62w-r2mf |
| Maven | org.springframework.ai:spring-ai-opensearch-store | >= 1.0.0, < 1.0.9 | 1.0.9 | GHSA-cmwh-w62w-r2mf |
| Maven | org.springframework.ai:spring-ai-opensearch-store | >= 1.1.0, < 1.1.8 | 1.1.8 | GHSA-cmwh-w62w-r2mf |