CVE-2026-22738

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917 CWE-88

Affected software

Vendor	Product	Versions
Spring	Spring AI	>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4

References

https://spring.io/security/cve-2026-22738Vendor Advisory

Timeline

Published: Mar 27, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-227398.6Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to th CVE-2026-22748.5A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker CVE-2026-227406.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp CVE-2026-227413.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can CVE-2026-227428.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing CVE-2026-227437.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled CVE-2026-227447.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strin CVE-2026-227455.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an applic CVE-2026-227463.7Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked CVE-2026-227478.1Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN valu CVE-2026-227486.5Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it CVE-2026-22759.6The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function c