Spring AI EUVD-2026-25994

Exploitation requires the Spring AI application to accept filter expression input from untrusted sources (user-supplied parameters, API requests, third-party integrations) and pass those expressions to vulnerable FilterExpressionConverter implementations without prior sanitization. The application must be using Spring AI versions 1.0.0-1.0.5 or 1.1.0-1.1.4 with vector store integration enabled and accessible via network interfaces. No authentication is required per CVSS vector (PR:N), meaning public-facing search or query endpoints that leverage filter expressions are immediately exploitable. Applications that only use hardcoded filter expressions or construct filters exclusively from trusted internal sources are not vulnerable. The scope is unchanged (S:U), so exploitation is contained within the vulnerable Spring AI component's security context and does not enable lateral movement to other application layers or systems.

The CVSS base score of 8.6 (High) reflects network-accessible exploitation requiring no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), presenting significant exposure for internet-facing applications. The impact profile shows high confidentiality impact (C:H) with low integrity and availability impacts (I:L/A:L), indicating attackers can primarily exfiltrate data through query manipulation while having limited ability to modify or disrupt operations. However, multiple risk signals suggest lower real-world urgency than the CVSS score alone: no CISA KEV listing indicates no confirmed active exploitation, no public POC is referenced, and EPSS data is unavailable for risk trending. The exploitation requires applications to accept untruated filter expressions from external sources and pass them to affected FilterExpressionConverter implementations-a deployment-specific condition that limits attack surface. The vulnerability is automatable once conditions are met (no complex timing or race conditions), but technical impact depends on what data the vector store contains and what query permissions the application service account has. Patches are available for both affected version branches (1.0.6 and 1.1.5), significantly reducing risk for organizations that can upgrade promptly.

An attacker sends a crafted HTTP request to a Spring AI-powered application endpoint that accepts user-defined search filters for vector similarity queries. The malicious filter expression contains unescaped special characters and operators that break out of the intended query structure when FilterExpressionConverter translates it to the vector store's native query language. The injected query commands retrieve sensitive embedding data or metadata beyond the user's authorized scope, exfiltrating confidential information indexed in the vector database. If public exploit code becomes available, automated scanning for vulnerable Spring AI applications would enable widespread exploitation.