CVE-2026-59319: RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | ) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Spring AI 2.0.0 are exposed if the application passes user-controlled metadata values to RedisChatMemoryRepository.findByMetadata() for a tag-typed metadata field. The issue affects indexed chat messages in the relevant RediSearch index.
What does an attacker need to exploit this?
An attacker needs the ability to supply a metadata value that the application forwards to findByMetadata(). No user interaction is required, but the attacker must have the privileges represented by the CVSS PR:L vector.
What data could be exposed?
Injected RediSearch syntax can break out of the intended tag clause and match all indexed chat messages across every conversation in the index. The stated impact is confidentiality loss; integrity and availability impacts are not identified.
What can be done before a fix is available?
Do not pass untrusted values directly to findByMetadata() on tag-typed metadata fields. Validate or constrain metadata values and apply RediSearch escaping before constructing or submitting the query value.