This CVE describes a SpEL injection flaw in Spring Data KeyValue, where unsanitized user input can be passed into a Sort parameter. When the repository query delegates evaluation to the SpelPropertyComparator, that input is interpreted as a Spring Expression Language expression. The flaw may allow an attacker to execute arbitrary code, read or modify data, or cause a denial of service. The weakness falls under CWE-917.

The vulnerability affects Spring's Spring Data KeyValue and Spring Data Redis. All releases from 2.7.0 up to 4.0.5, inclusive, are vulnerable, as listed. Any deployment using these libraries without an upgrade to a fixed version is exposed.

The CVSS score of 6.4 indicates a moderate risk, though the lack of an EPSS score means no estimate of exploitation probability is available. It is not listed in the CISA KEV catalog. Attackers can supply a malicious sort parameter in an HTTP request or API call, which is typically possible over a public-facing endpoint. The potential for remote code execution or data tampering makes this a serious threat.