Code injection in VMware Spring AI
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring AI | 1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5 | 1.0.6, 1.1.5 | Patch available | CNA |
| — | org.springframework.ai:spring-ai-vector-store (Maven) | 1.0.0 to before 1.0.6 | 1.0.6 | Patch available | GHSA-qc4j-qjqx-vr58 |
| — | org.springframework.ai:spring-ai-vector-store (Maven) | 1.1.0 to before 1.1.5 | 1.1.5 | Patch available | GHSA-qc4j-qjqx-vr58 |
- Spring AI VendorVMware Affected 1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5 Fixed in 1.0.6, 1.1.5 Patch available CNA
- org.springframework.ai:spring-ai-vector-store (Maven) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-qc4j-qjqx-vr58
- org.springframework.ai:spring-ai-vector-store (Maven) Vendor— Affected 1.1.0 to before 1.1.5 Fixed in 1.1.5 Patch available GHSA-qc4j-qjqx-vr58
Remediation
- Fix · CNA Spring AI (Spring) Fixed in 1.0.6, 1.1.5
- Fix · GHSA-qc4j-qjqx-vr58 org.springframework.ai:spring-ai-vector-store (Maven) Fixed in 1.0.6 Advisory →
- Fix · GHSA-qc4j-qjqx-vr58 org.springframework.ai:spring-ai-vector-store (Maven) Fixed in 1.1.5 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Spring AI 1.0.6, 1.1.5
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-29629 SQL injection in VMware Spring AIPriority MEDIUM 40
- TI-2026-29631 Uncontrolled resource consumption in VMware Spring AIPriority LOW 28
- TI-2026-29630 In Spring AI, having access to a shared environment can expose the ONNX model used by the…Priority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40967
- 2026-10-03 Alias added: GHSA-qc4j-qjqx-vr58
References
More VMware Spring Ai vulnerabilities
- TI-2026-18262 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2026-18254 CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter CVSS 3.1HIGH 8.6
- TI-2026-35287 Spring AI vector store metadata filtering to handle special characters in Elasticsearch… CVSS 3.1HIGH 8.6
- TI-2026-30221 Expression language injection in VMware Spring AI CVSS 3.1HIGH 8.6
- TI-2026-18266 Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching CVSS 3.1HIGH 8.6
- TI-2026-42449 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-40967 · CVE Program
- CVE-2026-40967 · NVD
- FIRST EPSS
- GHSA-qc4j-qjqx-vr58 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences