CVE-2026-40967: Code Injection
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.
Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40967?
CVE-2026-40967 has a medium severity rating due to the potential for altering vector store queries without proper validation.
How do I fix CVE-2026-40967?
To fix CVE-2026-40967, upgrade to the latest version of Spring AI that contains the necessary security patches.
Which versions of Spring AI are affected by CVE-2026-40967?
CVE-2026-40967 affects Spring AI versions from 1.0.0 to 1.0.5 and 1.1.0 to 1.1.4.
What causes CVE-2026-40967 vulnerability?
CVE-2026-40967 is caused by improper escaping of keys and values in FilterExpressionConverter implementations.
Can CVE-2026-40967 lead to data breaches?
Yes, CVE-2026-40967 could allow attackers to manipulate queries, potentially leading to unauthorized data access.