Spring AI’s FilterExpressionConverter component processes filter expressions and converts them into query language syntax for vector stores. The implementations for several filters fail to escape keys and values properly. As a result, an attacker can inject arbitrary text into the generated query, allowing them to manipulate the query logic or execute unintended commands. This flaw is a code injection vulnerability that can compromise the integrity of the underlying query processing system and potentially enable attackers to gain unauthorized access to data or execute arbitrary code. The weakness is identified as CWE‑94: Improper Handling of Code in Code Generation.

The affected products are Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. These ranges were fixed starting with Spring AI 1.0.6 and 1.1.5, respectively. Users running any of the affected releases are at risk.

The CVSS score of 8.6 indicates a high severity vulnerability. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the provided data, but the lack of a KEV designation suggests that it has not yet been widely exploited. The attack vector relies on providing a specially crafted filter expression that is processed by an application using the vulnerable Spring AI component. If the application exposes an interface for filter expressions, an attacker could supply malicious input to alter the query logic.