AIKIDO-2026-10679
spring-ai-vector-store is vulnerable to Code Injection
86
High Risk
This Affects:
spring-ai-vector-storeTL;DR
Affected versions of Spring AI are vulnerable to Code Injection. Various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Only applications that use VectorStore implementations and pass user-supplied input as a filterExpression are affected.
Who does this affect?
You are affected if using a vulnerable version and your applications uses VectorStore implementations.
Background info
spring-ai-vector-store is vulnerable to Code Injection in versions 1.1.0 - 1.1.4 and 1.0.0 - 1.0.5.
How to fix this
Upgrade the org.springframework.ai:spring-ai-vector-store library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.