Technical impact
The vulnerability in the CosmosDBVectorStore component of Spring AI allows an attacker to inject arbitrary SQL statements by manipulating the document ID field. This flaw can be exploited to read, modify, or delete data stored in the underlying Cosmos DB, potentially exposing sensitive information or corrupting data. The weakness corresponds to CWE‑89, a classic SQL injection vulnerability that directly jeopardizes database confidentiality and integrity when accessed by an attacker.
Affected Systems
This issue affects Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. Users running any of these releases should consider them vulnerable until they upgrade to version 1.0.6 or 1.1.5, where the flaw is fixed.
Risk and Exploitability
With a CVSS score of 8.8, the vulnerability is deemed high severity. No EPSS score is publicly available, and it is not listed in CISA KEV, indicating no confirmed public exploitation yet. Nevertheless, because the flaw is a remote SQL injection, an attacker can achieve arbitrary database code execution from a remote attacker without authentication, assuming the application accepts user‑provided document IDs. The high exploitability score reflects the potential for widespread impact if the application is exposed to untrusted input.
Github GHSA