High severity8.8NVD Advisory· Published Apr 28, 2026· Updated Apr 29, 2026
CVE-2026-40978
CVE-2026-40978
Description
SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.ai:spring-ai-azure-cosmos-db-storeMaven | >= 1.0.0, < 1.0.6 | 1.0.6 |
org.springframework.ai:spring-ai-azure-cosmos-db-storeMaven | >= 1.1.0, < 1.1.5 | 1.1.5 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-63c8-m9m2-cvr3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40978ghsaADVISORY
- spring.io/security/cve-2026-40978nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.