FKIE_CVE-2026-22729

Vulnerability from fkie_nvd - Published: 2026-03-18 08:16 - Updated: 2026-04-01 16:53
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Summary
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
References
security@vmware.comhttps://spring.io/security/cve-2026-22729Vendor Advisory
Impacted products
Vendor Product Version
vmware spring_ai *
vmware spring_ai *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F510851F-2162-4380-97A0-75456BC7875A",
              "versionEndExcluding": "1.0.4",
              "versionStartIncluding": "1.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34C3CF7E-1A85-4EFE-8CC0-03E85527B2D5",
              "versionEndExcluding": "1.1.3",
              "versionStartIncluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A JSONPath injection vulnerability in Spring AI\u0027s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u00a0\",\u00a0||, and\u00a0\u0026\u0026\u00a0are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n de JSONPath en el AbstractFilterExpressionConverter de Spring AI permite a usuarios autenticados eludir los controles de acceso basados en metadatos mediante expresiones de filtro manipuladas. La entrada controlada por el usuario pasada a FilterExpressionBuilder se concatena en consultas JSONPath sin el escape adecuado, lo que permite a los atacantes inyectar l\u00f3gica JSONPath arbitraria y acceder a documentos no autorizados.\n\nEsta vulnerabilidad afecta a las aplicaciones que utilizan almacenes vectoriales que extienden AbstractFilterExpressionConverter para aislamiento multi-inquilino, control de acceso basado en roles o filtrado de documentos basado en metadatos.\n\nLa vulnerabilidad ocurre cuando los valores proporcionados por el usuario en las expresiones de filtro no se escapan antes de ser insertados en las consultas JSONPath. Caracteres especiales como \u0027\"\u0027, \u0027||\u0027 y \u0027\u0026amp;\u0026amp;\u0027 se pasan sin escapar, lo que permite la inyecci\u00f3n de l\u00f3gica JSONPath arbitraria que puede alterar la sem\u00e1ntica de la consulta prevista."
    }
  ],
  "id": "CVE-2026-22729",
  "lastModified": "2026-04-01T16:53:35.810",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-18T08:16:31.000",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-22729"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.