CVE-2026-41713
Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
CVE-2026-41713- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
EUVDEUVD-2026-29449
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
EUVD-2026-29449- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5852-phmh-8fhr
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
GHSA-5852-phmh-8fhr- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
NVD
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
CVE-2026-41713- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSV
Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
CVE-2026-41713- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
OSVGHSA-5852-phmh-8fhr
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.
- Record
GHSA-5852-phmh-8fhr- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-1336
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ai:spring-ai-client-chatMaven |
before 1.0.7 | 1.0.7 |
org.springframework.ai:spring-ai-client-chatMaven |
1.1.0-M1 up to 1.1.6 | 1.1.6 |
org.springframework.ai:spring-ai-client-chatMaven |
before 1.0.7, plus listed versions 1.0.01.0.0-M71.0.0-M81.0.0-RC11.0.1 Show 5 moreShow less1.0.21.0.31.0.41.0.51.0.6 |
1.0.7 |
org.springframework.ai:spring-ai-client-chatMaven |
1.1.0-M1 up to 1.1.6, plus listed versions 1.1.01.1.0-M21.1.0-M31.1.0-M41.1.0-RC1 Show 5 moreShow less1.1.11.1.21.1.31.1.41.1.5 |
1.1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41713 is a high vulnerability (CVSS 8.2) in Vmware Spring Ai, published May 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in org.springframework.ai:spring-ai-client-chat 1.0.7.
References
spring.io/security/cve-2026-41713
nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N&version=3.1
github.com/advisories/GHSA-5852-phmh-8fhr