{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22738", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:49.675Z", "datePublished": "2026-03-27T05:21:07.168Z", "dateUpdated": "2026-03-27T05:21:07.168Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-03-27T05:21:07.168Z"}, "title": "SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution", "affected": [{"vendor": "Spring", "product": "Spring AI", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.5", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Spring AI, a SpEL injection vulnerability exists in\u00a0SimpleVectorStore\u00a0when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code.\u00a0Only applications that use\u00a0SimpleVectorStore\u00a0and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Spring AI, a SpEL injection vulnerability exists in&nbsp;<code>SimpleVectorStore</code>&nbsp;when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code.&nbsp;<span>Only applications that use</span><span>&nbsp;</span><code>SimpleVectorStore</code><span>&nbsp;</span><span>and pass user-supplied input as a filter expression key are affected.<br></span><span>This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.</span></p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-22738"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In Spring AI, a SpEL injection vulnerability exists in\u00a0SimpleVectorStore\u00a0when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code.\u00a0Only applications that use\u00a0SimpleVectorStore\u00a0and pass user-supplied input as a filter expression key are affected.\nThis issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4."}], "id": "CVE-2026-22738", "lastModified": "2026-03-27T06:16:37.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@vmware.com", "type": "Secondary"}]}, "published": "2026-03-27T06:16:37.663", "references": [{"source": "security@vmware.com", "url": "https://spring.io/security/cve-2026-22738"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,1.1.4)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "Spring AI", "source": "cna", "vendor": "Spring"}, "product": "spring", "vendor": "spring"}], "analysis": {"en": {"generated_at": "2026-03-27T06:20:41.856509+00:00", "value": {"mitigation_remediation": ["Upgrade Spring AI to version 1.0.5 or later in the 1.0.x line, or to 1.1.4 or later in the 1.1.x line.", "If an immediate upgrade is not possible, sanitize or reject any user\u2011supplied filter keys before they reach SimpleVectorStore, ensuring they contain no SpEL syntax.", "Limit the exposure of interfaces that accept filter keys to trusted users or IP ranges.", "Continuously monitor the application for abnormal SpEL expression activity or related error logs."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Spring AI releases prior to 1.0.5 in the 1.0.x line and prior to 1.1.4 in the 1.1.x line are affected. Any deployment that uses SimpleVectorStore and passes user\u2011supplied values as filter keys is vulnerable.", "description_and_impact": "In Spring AI's SimpleVectorStore a SpEL injection flaw allows attackers the ability to supply an unescaped filter expression key. The unsanitized input is evaluated as a Spring Expression Language expression, which can trigger execution of arbitrary code within the JVM. A successful exploit grants the attacker full control over the host, compromising confidentiality, integrity and availability of the entire application.", "risk_and_exploitability": "The CVSS base score is 9.8, indicating critical severity. EPSS data is not available and the vulnerability is not yet listed in KEV, yet the high score and remote code execution capability suggest an elevated risk of active exploitation. The attack vector is remote, as the attacker only needs to provide a malicious filter key through any interface that forwards it to SimpleVectorStore."}}}}, "created": "2026-03-27T08:30:56.648878+00:00", "updated": "2026-03-27T09:22:16.483845+00:00", "vendors": ["spring", "spring$PRODUCT$spring"], "weaknesses": ["CWE-94"]}