CVE-2026-40967CWE-94

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages

High · published April 28, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions:

Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-28T06:03Z
EPSS history
Timeline
  • 28 APR 06:03Z
    In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages
    cvelistv5