High severity8.6NVD Advisory· Published Apr 28, 2026· Updated Apr 29, 2026
CVE-2026-40967
CVE-2026-40967
Description
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.ai:spring-ai-vector-storeMaven | >= 1.0.0, < 1.0.6 | 1.0.6 |
org.springframework.ai:spring-ai-vector-storeMaven | >= 1.1.0, < 1.1.5 | 1.1.5 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-qc4j-qjqx-vr58ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40967ghsaADVISORY
- spring.io/security/cve-2026-40967nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.