CVE Intelligence
Analysis AI-assisted

CVE-2026-22738: Spring AI SimpleVectorStore SpEL Injection

A SpEL injection flaw in the SimpleVectorStore component of Spring AI can occur when user-supplied input is used as a filter expression key, potentially allowing arbitrary code execution. The record lists affected ranges from 1.0.0 before 1.0.5 and from 1.1.0 before 1.1.4. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22738 is an expression language injection issue (CWE-917) in Spring AI. According to the record, SimpleVectorStore can evaluate a user-supplied value used as a filter expression key. The vendor advisory is available at Spring security advisory.

Impact

  • The record describes possible arbitrary code execution by a malicious actor.
  • The CVSS score of 9.8 (critical) was recorded by VMware, with high confidentiality, integrity and availability impact as recorded.
  • According to the record, only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected.

Affected products and versions

  • The record lists Spring Spring AI and Vmware Spring Ai as affected products.
  • Stated ranges: from 1.0.0 before 1.0.5, and from 1.1.0 before 1.1.4.
  • The record's fixes list is empty. Because the stated ranges end at 1.0.5 and 1.1.4, versions at or above those endpoints appear to be outside the affected ranges (inference). Confirm against the vendor advisory.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC exploitation value is recorded as none, and automatable is recorded as yes.
  • The EPSS probability is 0.01087 (about 1.09 percent) with percentile 0.65053, as recorded.

Remediation and mitigation

  • Upgrade Spring AI to a release outside the affected ranges, such as 1.0.5 or later for the first range or 1.1.4 or later for the second, following vendor guidance.
  • Until patched, review code paths where external input can influence filter expression keys, and do not pass untrusted values as keys.
  • Restrict filter keys to a fixed allow-list defined by the application.

Detection guidance

  • Inventory application dependencies to identify Spring AI versions within the affected ranges.
  • At a high level, review application logs for unexpected expression parsing errors or unusual filter-related behavior.
  • Audit where SimpleVectorStore is used and whether request parameters reach filter construction.

Limitations of the available information

  • The record contains only a short description and one vendor advisory reference; the advisory body was not reviewed here.
  • No fixed-version field is populated, so fixed builds are inferred only from the range endpoints.
  • The EPSS values are recorded with date 2026-10-23 and should be treated as a point-in-time estimate.
  • Whether a given deployment is affected depends on its code, which this record cannot confirm.

Frequently asked questions

Which Spring AI versions are affected?

The record lists the ranges from 1.0.0 before 1.0.5 and from 1.1.0 before 1.1.4 for both listed products.

Is this vulnerability known to be exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

What should defenders do first?

Inventory Spring AI dependencies, upgrade beyond the stated ranges per vendor guidance, and stop passing untrusted input as filter expression keys.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.