Executive brief
Spring Data REST is a framework used to build web services that interact with databases. A security flaw exists where the system incorrectly processes certain update requests (JSON Patch) involving map-based data. An attacker with basic user access could exploit this to execute unauthorized commands or access sensitive information, potentially leading to a significant data breach.
Technical details
Spring Data REST is vulnerable to Spring Expression Language (SpEL) injection (CWE-917) when processing 'application/json-patch+json' requests. The vulnerability occurs when a persistent entity exposes a Map-typed property; the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without proper sanitization or validation. A remote attacker with low privileges can send a specially crafted JSON Patch request to execute arbitrary SpEL expressions. This can lead to unauthorized data access or modification. Patches are available in versions 4.5.12 and 5.0.6.
Affected products
- Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5
Timeline
- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
- 2026-06-10: disclosed: Initial advisory publication
- 2026-08-12: advisory: Advisory updated by GitHub