VMware Spring AI

SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.

Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

Unbounded persistent session allocation via repeated initialize requests

Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore

Predictable cache directory location allows local ONNX model substitution in Spring AI

LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API

Arbitrary File Write via Path Traversal in ResourceCacheService

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation