AIKIDO-2026-556969
spring-ai-elasticsearch-store is vulnerable to Improper Neutralization of Special Elements in Data Query Logic
80
High Risk
This Affects:
spring-ai-elasticsearch-storeTL;DR
Spring AI contains a query injection vulnerability in the metadata filtering functionality of its Elasticsearch, OpenSearch, and GemFire Vector Store integrations. Insufficient handling of special characters may allow attackers to manipulate filter expressions and execute unintended queries against the underlying vector database, potentially resulting in unauthorized data access or bypass of intended query restrictions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-ai-elasticsearch-store is vulnerable to Improper Neutralization of Special Elements in Data Query Logic in versions 1.0.0 - 1.0.8 and 1.1.0 - 1.1.7.
How to fix this
Upgrade the org.springframework.ai:spring-ai-elasticsearch-store library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant