A high‑severity JSONPath injection flaw in VMware Spring AI’s AbstractFilterExpressionConverter lets authenticated users insert arbitrary JSONPath logic into filter expressions. Because user‑controlled values are concatenated into the query string without proper escaping, an attacker can alter the intended query semantics and bypass metadata‑based access controls, thereby retrieving documents they should not be able to view. The vulnerability is a classic example of CWE‑917: Improper Handling of Encoded Data.

Any application that implements the Spring AI vector store and extends the AbstractFilterExpressionConverter is susceptible. This includes multi‑tenant deployments, role‑based access control rules, and any custom document filtering that relies on metadata. No specific version numbers are provided in the advisory, so all current releases prior to a vendor patch are potentially impacted.

The CVSS score of 8.6 indicates that the flaw can have a serious impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. However, because it requires the attacker to have authenticated access that includes permission to craft filter expressions, the attack vector is essentially in‑application. If an attacker obtains such access, the risk escalates to full unauthorized data disclosure.