In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
| Vendor | Product | Versions |
|---|---|---|
| spring | spring ai | 1.0.0, 1.1.0 |
Updated exploit availability to true and marked as actively exploited.
Updated exploit availability to false and actively exploited status to false.
Updated vendor to VMware, affected versions to 1.0.4 and 1.1.3, and severity to HIGH.
Initial creation
