# CVE-2026-22738: VMware Spring AI SpEL injection in SimpleVectorStore

Source: https://junglewise.ai/threats/cve-2026-22738-in-spring-ai-a-spel-injection-vulnerability-exists-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2026-22738 · Severity: critical · CVSS 9.8 · Published 2026-03-27

Spring AI is a framework used to integrate artificial intelligence capabilities into Java applications. A critical security flaw in its 'SimpleVectorStore' component allows an attacker to execute malicious code on the server. This occurs when the application takes untrusted user input and uses it as a key for filtering data, potentially leading to a full system takeover or data theft.

Technologies: [org.springframework.ai:spring-ai-vector-store (Maven)](https://junglewise.ai/threats/technologies/org-springframework-ai-spring-ai-vector-store), [VMware Spring Ai](https://junglewise.ai/threats/technologies/spring-ai). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-22738 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22738 being exploited in the wild.

**How severe is CVE-2026-22738?** Critical severity, with a CVSS score of 9.8, published 27 March 2026.

**Which products and versions are affected?** org.springframework.ai:spring-ai-vector-store (Maven) ECOSYSTEM:introduced=1.0.0,fixed=1.0.5; VMware Spring Ai 1.0.0 to 1.0.4, 1.1.0-M1 to 1.1.3.

**Is there a fix for CVE-2026-22738?** Yes. org.springframework.ai:spring-ai-vector-store (Maven): upgrade to 1.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22738 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22738?** Check whether you run org.springframework.ai:spring-ai-vector-store (Maven) or VMware Spring Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.ai:spring-ai-vector-store (Maven): upgrade to 1.0.5 or later

  ```sh
  # set org.springframework.ai:spring-ai-vector-store to 1.0.5 in your pom.xml or build.gradle
  ```


## Technical details

A Spring Expression Language (SpEL) injection vulnerability exists in the SimpleVectorStore component of Spring AI. The root cause is the improper neutralization of special elements when a user-provided value is utilized as a key within a filter expression. An unauthenticated remote attacker can exploit this by submitting a crafted SpEL expression, leading to arbitrary code execution (RCE) in the context of the application. This vulnerability is tracked as CVE-2026-22738 and has been addressed in versions 1.0.5 and 1.1.4.

## Affected products

- VMware Spring AI 1.0.0 to 1.0.4, 1.1.0-M1 to 1.1.3

## Identifiers

- CVE-2026-22738
- GHSA-fvh3-672c-7p6c

## Timeline

- 2026-03-27: disclosed
- 2026-03-27: advisory
- 2026-03-25: patched: Fix committed to repository

## References

- [https://spring.io/security/cve-2026-22738](https://spring.io/security/cve-2026-22738)
- [https://github.com/spring-projects/spring-ai/commit/ba9220b22383e430d5f801ce8e4fa01cf9e75f29](https://github.com/spring-projects/spring-ai/commit/ba9220b22383e430d5f801ce8e4fa01cf9e75f29)
- [https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5](https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5)
- [https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4](https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4)

## Related threats

- [Spring AI RedisChatMemoryRepository RediSearch injection in findByMetadata()](https://junglewise.ai/threats/cve-2026-59319-spring-ai-redischatmemoryrepository-redisearch-injection-in)
- [Spring AI path traversal in ResourceCacheService](https://junglewise.ai/threats/cve-2026-59294-spring-ai-path-traversal-in-resourcecacheservice)
- [Spring AI tool calling privilege escalation](https://junglewise.ai/threats/cve-2026-59318-spring-ai-tool-calling-privilege-escalation)
- [Spring AI Semantic Cache context hash isolation bypass](https://junglewise.ai/threats/cve-2026-59308-spring-ai-semantic-cache-context-hash-isolation-bypass)
- [Spring AI unbounded session accumulation denial of service](https://junglewise.ai/threats/cve-2026-59279-spring-ai-unbounded-session-accumulation-denial-of-service)