CVE-2026-22738: spring spring ai Expression Language Injection
Vulnerability summary
CVE-2026-22738 is a critical (CVSS 9.8) Expression Language Injection vulnerability in spring spring ai. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 10-05-2026Last modifiedVulnerability information updated.
Description
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Affected systems
Org.springframework.ai1 product
- spring-ai-vector-store≥ 1.0.0, < 1.0.5 | ≥ 1.1.0-M1, < 1.1.4
Spring1 product
- spring ai≥ 1.0.0, < 1.0.5 | ≥ 1.1.0, < 1.1.4
Vmware1 product
- spring_ai≥ 1.0.0, < 1.0.5 | ≥ 1.1.0, < 1.1.4
3 vendors · 3 products
