Vulnerability · Published Mar 18, 2026 · Assigned by vmware
CVE-2026-22729CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
High 8.6
In plain English
A high-severity expression language injection in Spring AI from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.ai:spring-ai-vector-store | 1.1.3 | GHSA-rp9g-qx29-88cp |
| Maven | org.springframework.ai:spring-ai-vector-store | 1.0.4 | GHSA-rp9g-qx29-88cp |
Affected products (as reported)
Weakness: CWE-917 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N