Spring Ai
Monthly
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request to be dispatched and invoked, which can escalate privileges when the out-of-boundary tool carries greater capabilities than the caller was granted. Affected are Spring AI 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0 (CPE cpe:2.3:a:vmware:spring_ai) in applications that actually use tool calling with a per-request tool list that restricts at least one tool relative to others, and where the attacker can influence the model's input; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (high attack complexity, unauthenticated) rather than the vendor's headline 9.8 AV:N/AC:L score, reflecting that exploitation is conditional ('under certain conditions') and not universally reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is low at 0.17% (7th percentile), and CISA SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total. Realized impact is bounded by the authority of whatever tool slips past the boundary.
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Remote unauthenticated attackers can access confidential data from other users' chat sessions in Spring AI applications due to insecure default configuration in the chat memory component. The vulnerability allows network-based exploitation with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and impacts confidentiality only (C:H/I:N/A:N), enabling cross-user data leakage in multi-tenant AI chat implementations. Reported by VMware, affecting Java-based Spring AI deployments where developers have not explicitly configured chat memory isolation.
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
SQL injection in Spring AI's CosmosDBVectorStore component (versions 1.0.0-1.0.5 and 1.1.0-1.1.4) enables authenticated remote attackers to execute arbitrary SQL queries through malicious document IDs, potentially achieving full database compromise including data exfiltration, modification, and denial of service. VMware has released patches in versions 1.0.6 and 1.1.5. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires low-privilege authenticated access to the vector store API.
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
Cypher injection in Spring AI Neo4j vector store (versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3) allows unauthenticated remote attackers to access confidential data stored in Neo4j databases. The vulnerability exists in Neo4jVectorFilterExpressionConverter where user-controlled filter expression keys are embedded into Cypher property accessors without proper backtick escaping, enabling attackers to break out of the intended property context and execute arbitrary Cypher queries. CVSS score of 7.5 reflects high confidentiality impact with network accessibility and low attack complexity, though no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the application server to issue HTTP requests to arbitrary internal or external destinations by supplying malicious media URLs in multimodal messages. Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 are affected. The vulnerability carries a CVSS score of 8.6 with high confidentiality impact and changed scope, indicating potential access to internal network resources. No public exploit identified at time of analysis.
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Spring Expression Language (SpEL) injection in the SimpleVectorStore component when user-supplied input is incorporated into filter expression keys. This critical vulnerability (CVSS 9.8) enables attackers to execute arbitrary code without authentication on applications using SimpleVectorStore with untrusted filter input. No public exploit identified at time of analysis, though the attack complexity is low and requires no user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Spring AI's AbstractFilterExpressionConverter fails to properly escape user-controlled input in JSONPath queries, allowing authenticated attackers to inject arbitrary expressions and bypass access controls in vector store implementations. This impacts applications relying on the converter for multi-tenant isolation, role-based access, or metadata-based document filtering, enabling attackers to access unauthorized documents. No patch is currently available.
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter component allows authenticated attackers to bypass metadata-based access controls and execute arbitrary SQL commands due to missing input sanitization. VMware Spring AI versions 1.0.x prior to 1.0.4 and 1.1.x prior to 1.1.3 are affected. With a CVSS score of 8.8, this vulnerability enables attackers with low-level privileges to compromise confidentiality, integrity, and availability of the database system through network-based attacks with low complexity.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Path traversal in Spring AI 1.1.0-1.1.x allows authenticated remote attackers to write arbitrary files outside the intended target directory by exploiting unsanitized LLM-influenced filenames in the Anthropic Skills API file-write workflow. The root cause is Spring AI passing filenames derived from LLM output directly to Path.resolve() without input sanitization, enabling directory escape via traversal sequences. No public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), though the high integrity impact (CVSS I:H) makes unauthorized file writes to restricted directories a meaningful concern in production deployments.
Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 are vulnerable to denial of service through uncontrolled resource consumption when processing maliciously crafted PDF files via the ForkPDFLayoutTextStripper component. Authenticated remote attackers can exhaust server memory and crash affected applications by uploading or processing specially designed PDFs. Vendor-released patches address the issue in versions 1.0.6 and 1.1.5.
Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 expose ONNX machine learning models to unauthorized disclosure when the application runs in shared hosting environments, allowing local users with limited system access to read sensitive model files and potentially reverse-engineer proprietary ML logic. The vulnerability stems from insecure temporary file handling (CWE-377) that fails to restrict file permissions on extracted model artifacts. Authentication requirements are minimal-only local system access is needed-making this a significant risk in multi-tenant cloud platforms and shared servers.
Spring AI fails to properly isolate conversation contexts when user-supplied input is passed directly as conversationId to VectorStoreChatMemoryAdvisor, allowing remote unauthenticated attackers to inject filter logic that exfiltrates sensitive data from other users' chat histories, including secrets and credentials. Exploitation requires moderately complex attack construction (AC:H) but no user interaction, affecting only applications with the specific vulnerable configuration pattern.
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request to be dispatched and invoked, which can escalate privileges when the out-of-boundary tool carries greater capabilities than the caller was granted. Affected are Spring AI 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0 (CPE cpe:2.3:a:vmware:spring_ai) in applications that actually use tool calling with a per-request tool list that restricts at least one tool relative to others, and where the attacker can influence the model's input; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (high attack complexity, unauthenticated) rather than the vendor's headline 9.8 AV:N/AC:L score, reflecting that exploitation is conditional ('under certain conditions') and not universally reproducible. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is low at 0.17% (7th percentile), and CISA SSVC rates Exploitation as none and Automatable as no, though Technical Impact is total. Realized impact is bounded by the authority of whatever tool slips past the boundary.
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that persists across conversation turns and manipulates AI model behavior. The vulnerability achieves high integrity impact (CVSS 8.2) through stored prompt injection, enabling attackers to alter model responses, extract sensitive context, or bypass application logic without authentication. No active exploitation confirmed at time of analysis, but the network-accessible attack surface and low complexity make this a priority for applications processing user-generated conversational input.
Remote unauthenticated attackers can access confidential data from other users' chat sessions in Spring AI applications due to insecure default configuration in the chat memory component. The vulnerability allows network-based exploitation with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and impacts confidentiality only (C:H/I:N/A:N), enabling cross-user data leakage in multi-tenant AI chat implementations. Reported by VMware, affecting Java-based Spring AI deployments where developers have not explicitly configured chat memory isolation.
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
SQL injection in Spring AI's CosmosDBVectorStore component (versions 1.0.0-1.0.5 and 1.1.0-1.1.4) enables authenticated remote attackers to execute arbitrary SQL queries through malicious document IDs, potentially achieving full database compromise including data exfiltration, modification, and denial of service. VMware has released patches in versions 1.0.6 and 1.1.5. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires low-privilege authenticated access to the vector store API.
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
Cypher injection in Spring AI Neo4j vector store (versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3) allows unauthenticated remote attackers to access confidential data stored in Neo4j databases. The vulnerability exists in Neo4jVectorFilterExpressionConverter where user-controlled filter expression keys are embedded into Cypher property accessors without proper backtick escaping, enabling attackers to break out of the intended property context and execute arbitrary Cypher queries. CVSS score of 7.5 reflects high confidentiality impact with network accessibility and low attack complexity, though no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the application server to issue HTTP requests to arbitrary internal or external destinations by supplying malicious media URLs in multimodal messages. Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 are affected. The vulnerability carries a CVSS score of 8.6 with high confidentiality impact and changed scope, indicating potential access to internal network resources. No public exploit identified at time of analysis.
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Spring Expression Language (SpEL) injection in the SimpleVectorStore component when user-supplied input is incorporated into filter expression keys. This critical vulnerability (CVSS 9.8) enables attackers to execute arbitrary code without authentication on applications using SimpleVectorStore with untrusted filter input. No public exploit identified at time of analysis, though the attack complexity is low and requires no user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Spring AI's AbstractFilterExpressionConverter fails to properly escape user-controlled input in JSONPath queries, allowing authenticated attackers to inject arbitrary expressions and bypass access controls in vector store implementations. This impacts applications relying on the converter for multi-tenant isolation, role-based access, or metadata-based document filtering, enabling attackers to access unauthorized documents. No patch is currently available.
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter component allows authenticated attackers to bypass metadata-based access controls and execute arbitrary SQL commands due to missing input sanitization. VMware Spring AI versions 1.0.x prior to 1.0.4 and 1.1.x prior to 1.1.3 are affected. With a CVSS score of 8.8, this vulnerability enables attackers with low-level privileges to compromise confidentiality, integrity, and availability of the database system through network-based attacks with low complexity.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Path traversal in Spring AI 1.1.0-1.1.x allows authenticated remote attackers to write arbitrary files outside the intended target directory by exploiting unsanitized LLM-influenced filenames in the Anthropic Skills API file-write workflow. The root cause is Spring AI passing filenames derived from LLM output directly to Path.resolve() without input sanitization, enabling directory escape via traversal sequences. No public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), though the high integrity impact (CVSS I:H) makes unauthorized file writes to restricted directories a meaningful concern in production deployments.
Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 are vulnerable to denial of service through uncontrolled resource consumption when processing maliciously crafted PDF files via the ForkPDFLayoutTextStripper component. Authenticated remote attackers can exhaust server memory and crash affected applications by uploading or processing specially designed PDFs. Vendor-released patches address the issue in versions 1.0.6 and 1.1.5.
Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 expose ONNX machine learning models to unauthorized disclosure when the application runs in shared hosting environments, allowing local users with limited system access to read sensitive model files and potentially reverse-engineer proprietary ML logic. The vulnerability stems from insecure temporary file handling (CWE-377) that fails to restrict file permissions on extracted model artifacts. Authentication requirements are minimal-only local system access is needed-making this a significant risk in multi-tenant cloud platforms and shared servers.
Spring AI fails to properly isolate conversation contexts when user-supplied input is passed directly as conversationId to VectorStoreChatMemoryAdvisor, allowing remote unauthenticated attackers to inject filter logic that exfiltrates sensitive data from other users' chat histories, including secrets and credentials. Exploitation requires moderately complex attack construction (AC:H) but no user interaction, affecting only applications with the specific vulnerable configuration pattern.