In Spring AI's SimpleVectorStore a SpEL injection flaw allows attackers the ability to supply an unescaped filter expression key. The unsanitized input is evaluated as a Spring Expression Language expression, which can trigger execution of arbitrary code within the JVM. A successful exploit grants the attacker full control over the host, compromising confidentiality, integrity and availability of the entire application.

Spring AI releases prior to 1.0.5 in the 1.0.x line and prior to 1.1.4 in the 1.1.x line are affected. Any deployment that uses SimpleVectorStore and passes user‑supplied values as filter keys is vulnerable.

The CVSS base score is 9.8, indicating critical severity. EPSS data is not available and the vulnerability is not yet listed in KEV, yet the high score and remote code execution capability suggest an elevated risk of active exploitation. The attack vector is remote, as the attacker only needs to provide a malicious filter key through any interface that forwards it to SimpleVectorStore.