Spring AI 1.x versions contain a flaw in the RedisFilterExpressionConverter where a user‑controlled string supplied as a FILTER value for a TAG field is inserted directly into the @field:{VALUE} RediSearch query without escaping. This improper input handling can be exploited to inject arbitrary search syntax, allowing an attacker to manipulate or expand the query logic. The result may be unauthorized data retrieval or manipulation of query results, impacting confidentiality and integrity of the stored data.

The vulnerability affects Spring AI for all releases from 1.0.0 up to, but not including, 1.0.5 as well as from 1.1.0 up to, but not including, 1.1.4. Systems running these versions should be considered at risk.

The CVSS score of 7.5 indicates high severity, and the exploitability is further suggested by the lack of escaping. While EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV, the absence of mitigation in earlier releases means the attack vector is likely via a user‑supplied filter expression, which can be invoked by any authenticated or potentially unauthenticated client depending on application configuration.