PT-2026-28324 · Vmware · Spring Ai

Published 2026-03-26 · Updated 2026-04-20 · CVE-2026-22738

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3

Description Spring AI's SimpleVectorStore component contains a SpEL injection flaw. This occurs when user-provided input is used as a filter expression key. A malicious actor can leverage this to execute arbitrary code. The issue impacts applications utilizing SimpleVectorStore and accepting user input for filter expression keys. Multiple sources confirm the potential for unauthenticated Remote Code Execution (RCE).

Recommendations Update Spring AI to version 1.0.5 or 1.1.4 to address this issue.

Fix

RCE

Code Injection

Argument Injection

Weakness Enumeration

CWE-94

CWE-88

CWE-917

Related Identifiers

CVE-2026-22738

GHSA-FVH3-672C-7P6C

Affected Products

Spring Ai

References · 19

• https://osv.dev/vulnerability/GHSA-fvh3-672c-7p6c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22738 · Security Note
• https://spring.io/security/cve-2026-22738 · Vendor Advisory
• https://github.com/spring-projects/spring-ai · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5 · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4 · Note
• https://github.com/spring-projects/spring-ai/commit/ba9220b22383e430d5f801ce8e4fa01cf9e75f29 · Note
• https://twitter.com/ToTo13ru_xakep/status/2040111495145537810 · Twitter Post
• https://i.redd.it/wt7s9zzimysg1.jpeg · Reddit Post
• https://twitter.com/pyn3rd/status/2040037595732934959 · Twitter Post
• https://twitter.com/pulsepatchio/status/2038995981354541497 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2037212462613975403 · Twitter Post
• https://twitter.com/TheHackerWire/status/2038013217289675164 · Twitter Post
• https://twitter.com/CVEnew/status/2037513374112608256 · Twitter Post
• https://twitter.com/v4bel/status/2039268612360622114 · Twitter Post