Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-40967

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

VectorNETWORK

PublishedApr 28, 2026, 07:16

Published Bysecurity@vmware.com

Base Score

Score8.6

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.springframework.ai:spring-ai-vector-store(Maven)1.0.01.0.6N/A

org.springframework.ai:spring-ai-vector-store(Maven)1.1.01.1.5N/A

References

https://spring.io/security/cve-2026-40967

Weakness Type

CWE-94

CVSS Metrics

Base Score

8.6

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK