Package Health/org.springframework.ai:spring-ai-vector-store

spring-ai-vector-store

Common vector store functionality for Spring AI

Latest 2.1.0-M1org.springframework.ai

Maven

78%

Total Score

healthy

Healthy, with strong maintenance and release evidence despite broad unpinned workflow references.

Are you affected? Scan for Free

Health Score Breakdown

Repo issue activity

The repository remains active, with 55 new issues and 83 new pull requests in the last month, although only 6 pull requests were merged during that period. The mixed throughput is a minor caution rather than abandonment evidence.

Repo tooling

The project uses Maven, but no repository security-scanning tools were detected. This is a modest transparency gap, partially offset by the active organization and security policy.

Version stability

Version 2.1.0-M1 is a pre-release, and 40% of recent releases are pre-releases, so consumers should expect more change than with a final release.

Workflow audit

All 17 workflows were analyzed with no untrusted checkout or script-injection findings, but 78 of 88 action references are unpinned and high-confidence template-injection and floating-image findings remain. These are workflow hygiene concerns, not a standalone dependency verdict.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10679 spring-ai-vector-store is vulnerable to Code Injection in versions 1.1.0 - 1.1.4 and 1.0.0 - 1.0.5.	1.0.0 - 1.0.51.1.0 - 1.1.4	High
CVE-2026-22738 org.springframework.ai:spring-ai-vector-store is vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in versions 1.0.0 - 1.0.5 and 1.1.0-M1 - 1.1.4.	1.0.0 - 1.0.51.1.0-M1 - 1.1.4	Critical
CVE-2026-22729 org.springframework.ai:spring-ai-vector-store is vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') in versions 1.1.0-M1 - 1.1.3 and 0.0.0 - 1.0.4.	0.0.0 - 1.0.41.1.0-M1 - 1.1.3	High