The vulnerability occurs in RedisChatMemoryRepository.findByMetadata() where metadata values supplied by callers are incorporated into RediSearch tag and text queries without escaping. Because RediSearchUtil.escape() is not applied, an attacker can inject RediSearch syntax such as x} | * to break out of the tag clause. This allows a crafted input to match all indexed chat messages across every conversation, effectively leaking data that should be restricted to a single conversation. The flaw results in an information‑disclosure compromise; it does not provide execution or denial‑of‑service capabilities.

Spring AI version 2.0.0 is affected. The issue is present in the Spring AI library that implements the RedisChatMemoryRepository class. Applications that use this library and invoke findByMetadata() with user‑controlled metadata values are vulnerable.

The CVSS score of 4.3 places this flaw in the low‑severity range, indicating that the impact is limited to confidentiality rather than integrity or availability. The EPSS score is 0.00215, signifying a very low probability of exploitation, and the flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Nevertheless, an attacker who can control metadata keys or values can directly inject RediSearch syntax, bypassing conversation boundaries. The primary attack vector is through any user‑controlled input passed to findByMetadata(); no elevated privileges or special network access are required beyond the normal application context. Given the low CVSS, very low EPSS, and absence from KEV, the risk can be considered moderate but still warrants mitigation to prevent cross‑conversation data leaks.