CVE-2026-22738
EUVD-2026-1653527.03.2026, 06:16
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| vmware | spring_ai | 1.0.0 ≤ 𝑥 < 1.0.5 |
| vmware | spring_ai | 1.1.0 ≤ 𝑥 < 1.1.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.