DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages

Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter…

Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor

Predictable cache directory location allows local ONNX model substitution in Spring AI

Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Unbounded persistent session allocation via repeated initialize requests

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly…

Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore

Arbitrary File Write via Path Traversal in ResourceCacheService

LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`

In Spring AI, having access to a shared environment can expose the ONNX model used by the application

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation