Vulnerability · Published Mar 27, 2026 · Assigned by vmware
CVE-2026-22738SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
Critical 9.8
In plain English
A critical-severity argument injection in Spring AI from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.ai:spring-ai-vector-store | 1.0.5 | GHSA-fvh3-672c-7p6c |
| Maven | org.springframework.ai:spring-ai-vector-store | 1.1.4 | GHSA-fvh3-672c-7p6c |
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H