{"id":"CVE-2026-22738","aliases":["EUVD-2026-16535","GHSA-fvh3-672c-7p6c"],"status":"published","title":"SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01107,"percentile":0.66258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-88","CWE-917","CWE-94"],"published":"2026-03-27T05:21:07Z","modified":"2026-10-28T02:30:53Z","exploits":[{"source":"pocgithub","id":"n0n4m3x41/CVE-2026-22738-POC","title":"n0n4m3x41/CVE-2026-22738-POC","date":"2026-04-02","url":"https://github.com/n0n4m3x41/CVE-2026-22738-POC"},{"source":"pocgithub","id":"rockmelodies/CVE-2026-22738","title":"rockmelodies/CVE-2026-22738","date":"2026-04-03","url":"https://github.com/rockmelodies/CVE-2026-22738"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.ai:spring-ai-vector-store","fixed_in":["1.0.5","1.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ai:spring-ai-vector-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.ai:spring-ai-vector-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-M1"},{"fixed":"1.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ai:spring-ai-vector-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.5"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.ai:spring-ai-vector-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-M1"},{"fixed":"1.1.4"}]}],"versions":["1.1.0","1.1.0-M1","1.1.0-M2","1.1.0-M3","1.1.0-M4","1.1.0-RC1","1.1.1","1.1.2","1.1.3"]}],"products":[{"vendor":"spring","product":"spring ai"},{"vendor":"vmware","product":"spring ai"},{"vendor":"vmware","product":"spring_ai"}],"references":[{"url":"https://spring.io/security/cve-2026-22738","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22738","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-ai/commit/ba9220b22383e430d5f801ce8e4fa01cf9e75f29","tags":["web"]},{"url":"https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5","tags":["web"]},{"url":"https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fvh3-672c-7p6c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22738.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-ai","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-22738","title":"SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T05:21:07.168Z","modified":"2026-05-10T13:04:38.045Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-16535","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T05:21:07Z","modified":"2026-05-10T13:04:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:05:13.690762Z"}],"ghsa":[{"id":"GHSA-fvh3-672c-7p6c","title":"Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\n\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T06:31:42Z","modified":"2026-05-13T13:44:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-88","CWE-94","CWE-917"],"updated_at":"2026-11-02T14:40:08.003212Z"}],"nvd":[{"id":"CVE-2026-22738","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T06:16:37.663Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-917","CWE-88"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-22738","title":"SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T05:21:07.168Z","modified":"2026-10-28T02:30:53.364897566Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-fvh3-672c-7p6c","title":"Spring AI: SpEL injection is triggered when a user-supplied value is used as a filter expression key","description":"In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.\n\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.","status":"published","published":"2026-03-27T06:31:42Z","modified":"2026-05-13T14:01:28.526425Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-88","CWE-917","CWE-94"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}