AIKIDO-2026-11173
spring-data-rest-core is vulnerable to SpEL Expression Injection
81
High Risk
This Affects:
spring-data-rest-coreTL;DR
When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. An attacker who can issue PATCH requests against an affected endpoint can craft a map-key segment that breaks out of the intended indexer literal and evaluates an arbitrary SpEL sub-expression within the context of the aggregate root.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-data-rest-core is vulnerable to SpEL Expression Injection in versions 0.0.1 - 3.7.19, 4.0.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11 and 5.0.0 - 5.0.5.
How to fix this
Upgrade the org.springframework.data:spring-data-rest-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant