CVE-2026-22729
Description
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
How to fix
- vmware spring_ai1.0.4, 1.1.3 or later
- org.springframework.ai:spring-ai-vector-store1.1.3, 1.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware spring_ai | 1.0.0 ≤ v < 1.0.4, 1.1.0 ≤ v < 1.1.3 | 1.0.4, 1.1.3 |
| org.springframework.ai:spring-ai-vector-storeMaven | 1.1.0-M1 ≤ v < 1.1.3, v < 1.0.4 | 1.1.3, 1.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.