The flaw is an expression language injection in Spring AI’s SimpleVectorStore, where an unescaped user‑supplied key is inserted directly into a SpEL filter expression. This allows an attacker to inject arbitrary Spring Expression Language code that is executed by the application, enabling full compromise of the host system. The weakness is a classic input validation failure (CWE‑917) and expression injection (CWE‑88) with severe consequences.

Spring AI SimpleVectorStore versions earlier than 1.0.5 of the 1.0.x line and earlier than 1.1.4 of the 1.1.x line are vulnerable. Any deployment that uses SimpleVectorStore and passes user‑controlled values as filter keys is affected.

The issue carries a CVSS score of 9.8, indicating critical severity. The EPSS indicates an exploitation probability under 1 percent, and the vulnerability is not listed in the national known exploited vulnerabilities catalog, marking it as a high‑risk, yet not widely exploited threat. Based on the description, the attack vector would be remote, leveraging user input over a network or web interface to trigger the injection.