CVE-2026-22729 CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
Authenticated attackers can inject JSONPath logic to bypass metadata access controls and read unauthorized documents in Spring AI vector stores.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22729?
CVE-2026-22729 is a high-severity code injection vulnerability in VMware Spring AI, published on 18 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.
This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.
The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
Weakness: CWE-917
Which versions are affected by CVE-2026-22729?
4 open source packages ship an affected version, including org.springframework.ai:spring-ai-vector-store. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.ai:spring-ai-vector-store Maven | All versions | 1.0.4 |
org.springframework.ai:spring-ai-vector-store Maven | All versions | 1.0.4 |
org.springframework.ai:spring-ai-vector-store Maven | From 1.1.0-M1 | 1.1.3 |
org.springframework.ai:spring-ai-vector-store Maven | From 1.1.0-M1 | 1.1.3 |
Products include Vmware Spring Ai.
How do I fix CVE-2026-22729?
Upgrade org.springframework.ai:spring-ai-vector-store to a fixed version for your release line: 1.0.4 or 1.1.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-22729 being exploited?
There is no known exploitation of CVE-2026-22729 in the wild and no public exploit code.
Other vulnerabilities in VMware Spring AI
- CVE-2026-22738 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
- CVE-2026-40978 Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
- CVE-2026-22730 CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
- CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-41705 Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
Sources
Also known as GHSA-rp9g-qx29-88cp.