PT-2026-28324 · Vmware · Spring Ai

Published 2026-03-26 · Updated 2026-04-01 · CVE-2026-22738

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.4 and versions 1.1.0 through 1.1.3

Description A SpEL injection flaw exists in the SimpleVectorStore component of Spring AI when a user-supplied value is used as a filter expression key. A malicious actor could potentially execute arbitrary code by exploiting this issue. Applications utilizing SimpleVectorStore and accepting user-provided input for filter expression keys are susceptible. The vulnerability involves the use of Spring Expression Language (SpEL), which, when combined with vector databases, can allow filter keys to become a pathway for remote code execution if user input is not properly handled.

Recommendations Update to Spring AI version 1.0.5 or later. Update to Spring AI version 1.1.4 or later.

Fix

Code Injection

Weakness Enumeration

CWE-917

CWE-94

Related Identifiers

CVE-2026-22738

GHSA-FVH3-672C-7P6C

Affected Products

Spring Ai

References · 13

• https://osv.dev/vulnerability/GHSA-fvh3-672c-7p6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22738 · Security Note
• https://github.com/spring-projects/spring-ai/commit/ba9220b22383e430d5f801ce8e4fa01cf9e75f29 · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5 · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4 · Note
• https://github.com/spring-projects/spring-ai · Note
• https://twitter.com/pulsepatchio/status/2038995981354541497 · Twitter Post
• https://spring.io/security/cve-2026-22738 · Note
• https://twitter.com/the_yellow_fall/status/2037212462613975403 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038013217289675164 · Twitter Post
• https://twitter.com/CVEnew/status/2037513374112608256 · Twitter Post
• https://twitter.com/0dayPublishing/status/2037400285878927782 · Twitter Post
• https://twitter.com/v4bel/status/2039268612360622114 · Twitter Post