Executive brief
Spring AI, a framework for integrating artificial intelligence into Java applications, contains a security vulnerability in its Milvus database integration. An attacker can use specially crafted document identifiers to manipulate database queries, potentially leading to unauthorized data access or modification. Organizations using Spring AI with Milvus should upgrade to versions 1.0.7 or 1.1.6 to protect their data and operations.
Technical details
A filter-expression injection vulnerability (CWE-917) exists in Spring AI's MilvusVectorStore#doDelete(List) implementation. The root cause is the failure to properly sanitize document IDs before they are incorporated into expression language statements used for database operations. A remote attacker can exploit this by providing malicious document IDs that alter the logic of the filter expression. This can result in unauthorized data retrieval, modification, or deletion within the Milvus vector database. The vulnerability is addressed in Spring AI versions 1.0.7 and 1.1.6.
Affected products
- VMware Spring AI 1.0.0 to 1.0.6, 1.1.0 to 1.1.5
Timeline
- 2026-05-09: advisory: Initial disclosure by VMware/Spring