Spring AI vulnerabilities
4 known vulnerabilities in Spring AI from VMware. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
Spring AI: Improper Neutralization of Special Elements Used in a Template Engine
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across con
- 7.5 High severity
Spring AI: Incorrect Default Permissions
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
- 8.8 High severity
Spring AI: Improper Neutralization of Special Elements used in an SQL Command
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
- 8.6 High severity
Spring AI: Improper Neutralization of Special Elements used in an Expression Language Statement
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated