Executive brief
Spring AI is a framework used to integrate Artificial Intelligence capabilities into Java applications. A vulnerability in its conversation memory component allows malicious users to 'poison' a chat history with specially crafted text. This can trick the AI into ignoring its safety instructions or performing unintended actions in future interactions, potentially leading to unauthorized data access or manipulation of the application's logic.
Technical details
A prompt injection vulnerability exists in the Spring AI 'PromptChatMemoryAdvisor' component due to improper neutralization of special elements (CWE-1336). When an application stores user-controlled input in conversation memory, an attacker can craft malicious input that is later interpreted as instructions rather than data when the model retrieves that history. This 'memory poisoning' allows an attacker to bypass system prompts and manipulate the LLM's behavior in subsequent conversation turns. The vulnerability is reachable over the network without authentication or user interaction. Patches are available in versions 1.0.7 and 1.1.6.
Affected products
- Spring spring-ai-client-chat < 1.0.7, >= 1.1.0-M1, < 1.1.6
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-18: patched: Advisory updated with reviewed status and patched versions.