CVE-2026-22729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22729", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:41.497Z", "datePublished": "2026-03-18T07:39:56.739Z", "dateUpdated": "2026-03-18T15:35:10.685Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-03-18T07:39:56.739Z"}, "title": "CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter", "datePublic": "2026-03-17T07:32:00.000Z", "affected": [{"vendor": "VMware", "product": "Spring AI", "packageName": "Spring AI", "versions": [{"status": "affected", "version": "1.0.x", "lessThan": "1.0.4", "versionType": "OSS"}, {"status": "affected", "version": "1.1.x", "lessThan": "1.1.3", "versionType": "oss"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u00a0\",\u00a0||, and\u00a0&&\u00a0are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p><p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p><p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like&nbsp;<code>\"</code>,&nbsp;<code>||</code>, and&nbsp;<code>&amp;&amp;</code>&nbsp;are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-22729"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-917", "lang": "en", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T14:50:07.381087Z", "id": "CVE-2026-22729", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T15:35:10.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T14:50:07.381087Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T14:50:24.509Z"}}], "cna": {"title": "CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Spring AI", "versions": [{"status": "affected", "version": "1.0.x", "lessThan": "1.0.4", "versionType": "OSS"}, {"status": "affected", "version": "1.1.x", "lessThan": "1.1.3", "versionType": "oss"}], "packageName": "Spring AI", "defaultStatus": "unaffected"}], "datePublic": "2026-03-17T07:32:00.000Z", "references": [{"url": "https://spring.io/security/cve-2026-22729"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u00a0\",\u00a0||, and\u00a0&&\u00a0are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.", "supportingMedia": [{"type": "text/html", "value": "<p>A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p><p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p><p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like&nbsp;<code>\"</code>,&nbsp;<code>||</code>, and&nbsp;<code>&amp;&amp;</code>&nbsp;are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-03-18T07:39:56.739Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22729", "state": "PUBLISHED", "dateUpdated": "2026-03-18T15:35:10.685Z", "dateReserved": "2026-01-09T06:54:41.497Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-03-18T07:39:56.739Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "Spring AI", "product": "Spring AI", "vendor": "VMware", "versions": [{"lessThan": "1.0.4", "status": "affected", "version": "1.0.x", "versionType": "OSS"}, {"lessThan": "1.1.3", "status": "affected", "version": "1.1.x", "versionType": "oss"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "F510851F-2162-4380-97A0-75456BC7875A", "versionEndExcluding": "1.0.4", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "34C3CF7E-1A85-4EFE-8CC0-03E85527B2D5", "versionEndExcluding": "1.1.3", "versionStartIncluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like\u00a0\",\u00a0||, and\u00a0&&\u00a0are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de JSONPath en el AbstractFilterExpressionConverter de Spring AI permite a usuarios autenticados eludir los controles de acceso basados en metadatos mediante expresiones de filtro manipuladas. La entrada controlada por el usuario pasada a FilterExpressionBuilder se concatena en consultas JSONPath sin el escape adecuado, lo que permite a los atacantes inyectar l\u00f3gica JSONPath arbitraria y acceder a documentos no autorizados.\n\nEsta vulnerabilidad afecta a las aplicaciones que utilizan almacenes vectoriales que extienden AbstractFilterExpressionConverter para aislamiento multi-inquilino, control de acceso basado en roles o filtrado de documentos basado en metadatos.\n\nLa vulnerabilidad ocurre cuando los valores proporcionados por el usuario en las expresiones de filtro no se escapan antes de ser insertados en las consultas JSONPath. Caracteres especiales como '\"', '||' y '&amp;&amp;' se pasan sin escapar, lo que permite la inyecci\u00f3n de l\u00f3gica JSONPath arbitraria que puede alterar la sem\u00e1ntica de la consulta prevista."}], "id": "CVE-2026-22729", "lastModified": "2026-06-17T10:20:18.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22729", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T14:50:07.381087Z", "version": "2.0.3"}}]}, "published": "2026-03-18T08:16:31.000", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-22729"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.x,1.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.1.x,1.1.3)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "Spring AI", "source": "cna", "vendor": "VMware"}, "product": "spring", "vendor": "vmware"}], "analysis": {"en": {"generated_at": "2026-04-02T03:04:01.715792+00:00", "value": {"mitigation_remediation": ["Consult VMware Spring AI\u2019s security advisories and apply any available patch or update that fixes JSONPath escaping.", "If an update is not yet available, review the filter expression handling code to escape or validate user input before concatenation.", "Disable or restrict advanced filter features that allow arbitrary JSONPath expressions until a fix is deployed.", "Monitor authentication and filter\u2011expression activity for signs of abuse.", "Implement a least\u2011privilege model so that only trusted users can construct complex filter expressions."], "summary": {"action": "Immediate Patch", "impact": "Metadata access bypass via JSONPath injection"}, "threat_synthesis": {"affected_systems": "Any application that implements the Spring AI vector store and extends the AbstractFilterExpressionConverter is susceptible. This includes multi\u2011tenant deployments, role\u2011based access control rules, and any custom document filtering that relies on metadata. No specific version numbers are provided in the advisory, so all current releases prior to a vendor patch are potentially impacted.", "description_and_impact": "A high\u2011severity JSONPath injection flaw in VMware Spring AI\u2019s AbstractFilterExpressionConverter lets authenticated users insert arbitrary JSONPath logic into filter expressions. Because user\u2011controlled values are concatenated into the query string without proper escaping, an attacker can alter the intended query semantics and bypass metadata\u2011based access controls, thereby retrieving documents they should not be able to view. The vulnerability is a classic example of CWE\u2011917: Improper Handling of Encoded Data.", "risk_and_exploitability": "The CVSS score of 8.6 indicates that the flaw can have a serious impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, because it requires the attacker to have authenticated access that includes permission to craft filter expressions, the attack vector is essentially in\u2011application. If an attacker obtains such access, the risk escalates to full unauthorized data disclosure."}}}}, "created": "2026-03-18T10:41:41.098628+00:00", "updated": "2026-04-02T08:00:03.400754+00:00", "vendors": ["vmware", "vmware$PRODUCT$spring"]}