Read the docs
TI-2026-18254 Aliases CVE-2026-22729GHSA-rp9g-qx29-88cp

CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

Priority MEDIUM 44CWE-917Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-917.

Summary

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix Fixed Spring AI (VMware): 1.0.4, 1.1.3org.springframework.ai:spring-ai-vector-store (Maven): 1.1.3, 1.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring AI1.0.x to before 1.0.4; 1.1.x to before 1.1.31.0.4, 1.1.3Patch availableCNA
—org.springframework.ai:spring-ai-vector-store (Maven)1.1.0-M1 to before 1.1.31.1.3Patch availableGHSA-rp9g-qx29-88cp
—org.springframework.ai:spring-ai-vector-store (Maven)before 1.0.41.0.4Patch availableGHSA-rp9g-qx29-88cp
  • Spring AI VendorVMware Affected 1.0.x to before 1.0.4; 1.1.x to before 1.1.3 Fixed in 1.0.4, 1.1.3 Patch available CNA
  • org.springframework.ai:spring-ai-vector-store (Maven) Vendor— Affected 1.1.0-M1 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-rp9g-qx29-88cp
  • org.springframework.ai:spring-ai-vector-store (Maven) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-rp9g-qx29-88cp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*1.0.0 to before 1.0.4; 1.1.0 to before 1.1.3VulnerableVMware
  • cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.4; 1.1.0 to before 1.1.3 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring AI (VMware) Fixed in 1.0.4, 1.1.3
  • Fix · GHSA-rp9g-qx29-88cp org.springframework.ai:spring-ai-vector-store (Maven) Fixed in 1.1.3 Advisory →
  • Fix · GHSA-rp9g-qx29-88cp org.springframework.ai:spring-ai-vector-store (Maven) Fixed in 1.0.4 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    VMware Spring AI 1.0.4, 1.1.3

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-18255 CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22729
  2. 2026-10-03 Alias added: GHSA-rp9g-qx29-88cp

References

Advisory 2

Other 3

  • TI-2026-18262 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2026-29618 Code injection in VMware Spring AI CVSS 3.1HIGH 8.6
  • TI-2026-35287 Spring AI vector store metadata filtering to handle special characters in Elasticsearch… CVSS 3.1HIGH 8.6
  • TI-2026-30221 Expression language injection in VMware Spring AI CVSS 3.1HIGH 8.6
  • TI-2026-18266 Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching CVSS 3.1HIGH 8.6
  • TI-2026-42449 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences