A missing input sanitization in VMware Spring AI’s MariaDBFilterExpressionConverter enables SQL injection. Attackers could inject arbitrary SQL statements to bypass metadata‑based access controls, potentially leading to unauthorized disclosure, modification, or deletion of database contents. The flaw is identified as CWE‑89, reflecting improper handling of user input in SQL queries.

The vulnerability affects VMware Spring AI. No specific product version is advertised in the advisory, so all current and prior releases might be vulnerable until a vendor‑issued update resolves the issue. Administrators should verify the installed version and consult VMware’s security notices for remediation guidance.

The CVSS score of 8.8 indicates a high‑severity risk, while the EPSS score of less than 1% suggests a low probability of exploitation today. The vulnerability is not in CISA’s KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw remotely by submitting crafted filter expressions that the converter processes, enabling arbitrary SQL execution that could compromise confidentiality, integrity, and availability.