Junglewise Threat Intelligence

CVE-2026-47835: VMware Spring AI query injection in Vector Stores

CVE-2026-47835 · Severity: high · CVSS 8.6 · Published 2026-06-15

Technologies: VMware Spring Ai. Vendors: VMware, Spring.

Executive brief

Spring AI's vector store components (Elasticsearch, OpenSearch, and GemFire integrations) fail to properly escape special characters in metadata filtering queries, allowing attackers to inject arbitrary query logic. An unauthenticated remote attacker can exploit this to extract sensitive data, modify search results, or potentially access unauthorized information from the underlying vector databases.

Technical details

The vulnerability is a query injection flaw (CWE-943: Improper Neutralization of Special Elements in Data Query Logic) in Spring AI's vector store filter expression converters for Elasticsearch, OpenSearch, and GemFire. The affected components fail to properly escape tab, newline, and carriage-return characters in metadata filtering queries before passing them to the underlying vector databases. This allows an unauthenticated remote attacker to inject special characters that modify the query logic and force execution of arbitrary database queries. The vulnerability requires no user interaction and affects systems where these vector stores are exposed over a network. The fix escapes these special characters in the filter expression conversion logic. Patches are available in Spring AI 1.0.9 and 1.1.8.

Affected products

  • Spring spring-ai-elasticsearch-store 1.0.0 through 1.0.8, 1.1.0 through 1.1.7
  • Spring spring-ai-opensearch-store 1.0.0 through 1.0.8, 1.1.0 through 1.1.7
  • Spring spring-ai-gemfire-store 1.0.0 through 1.0.8, 1.1.0 through 1.1.7

Timeline

  • 2026-06-15: disclosed: Published by GitHub Advisory Database and NVD
  • 2026-06-12: patched: Spring AI 1.0.9 and 1.1.8 released with fixes

References

Related threats