Maven package
org.springframework.data/spring-data-mongodb
pkg:maven/org.springframework.data/spring-data-mongodb
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-41717 | Hig | 8.1 | >= 5.0.0, < 5.0.6 | 5.0.6 | Jun 10, 2026 | Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring D | |
| CVE-2026-41696 | Med | 5.9 | >= 5.0.0, < 5.0.6 | 5.0.6 | Jun 10, 2026 | Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring | |
| CVE-2022-22980 | Cri | 9.8 | >= 3.4.0, < 3.4.1 | 3.4.1 | Jun 23, 2022 | A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized. |
- affected >= 5.0.0, < 5.0.6fixed 5.0.6
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring D
- affected >= 5.0.0, < 5.0.6fixed 5.0.6
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected versions: Spring
- affected >= 3.4.0, < 3.4.1fixed 3.4.1
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.