[CVE-2026-47835] In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary que…

Descripción técnica

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

Puntuación CVSS

Score: 8.6/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Productos afectados

Spring ai — Vmware

Debilidades (CWE)

CWE-943

Fuente oficial

Publicado en NIST NVD.