GHSA-44f4-gvwj-6qg3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-44f4-gvwj-6qg3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-44f4-gvwj-6qg3/GHSA-44f4-gvwj-6qg3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-44f4-gvwj-6qg3
- Aliases
- Published
- 2026-03-27T06:31:43Z
- Modified
- 2026-03-29T15:56:27Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters
- Details
-
In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
- Database specific
{ "cwe_ids": [ "CWE-74", "CWE-943" ], "github_reviewed": true, "github_reviewed_at": "2026-03-29T15:36:29Z", "nvd_published_at": "2026-03-27T06:16:38Z", "severity": "HIGH" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-22744
- https://github.com/spring-projects/spring-ai/commit/707e990c9152aabb9c9226053725efa2ada72223
- https://github.com/spring-projects/spring-ai
- https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5
- https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4
- https://spring.io/security/cve-2026-22744
Affected packages
Maven / org.springframework.ai:spring-ai-redis-store
Package
- Name
- org.springframework.ai:spring-ai-redis-store
- View open source insights on deps.dev
- Purl
- pkg:maven/org.springframework.ai/spring-ai-redis-store
Maven / org.springframework.ai:spring-ai-redis-store
Package
- Name
- org.springframework.ai:spring-ai-redis-store
- View open source insights on deps.dev
- Purl
- pkg:maven/org.springframework.ai/spring-ai-redis-store