PT-2026-28326 · Vmware+1 · Spring Ai+1

Published 2026-03-26 · Updated 2026-03-30 · CVE-2026-22743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.4 Spring AI versions 1.1.0 through 1.1.3

Description The software contains a Cypher injection issue within the Neo4jVectorFilterExpressionConverter component. When a user-controlled string is used as a filter expression key, the doKey() function incorporates the key into a Cypher property accessor using backticks. The software only removes double quotes but does not escape embedded backticks, which can lead to potential injection attacks. The vulnerable component is Neo4jVectorFilterExpressionConverter. The vulnerable parameter is the filter expression key.

Recommendations Update Spring AI to version 1.0.5 or later. Update Spring AI to version 1.1.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-943

CWE-89

Related Identifiers

BDU:2026-05617

CVE-2026-22743

GHSA-7CJ7-RCW6-P68V

Affected Products

Neo4J

Spring Ai

References · 11

• https://spring.io/security/cve-2026-22743 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cj7-rcw6-p68v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05617 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22743 · Security Note
• https://github.com/spring-projects/spring-ai · Note
• https://github.com/spring-projects/spring-ai/commit/3a46c7dd00e4adc17a132b9438149bde94da244f · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4 · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5 · Note
• https://twitter.com/CVEnew/status/2037513365740830840 · Twitter Post
• https://vuldb.com/ru/vuln/353815 · Note
• https://twitter.com/CCBalert/status/2038618365183283256 · Twitter Post