7.5
High
CVE-2026-22743 Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter
Description
Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey() embeds the key into a backtick-delimited Cypher property accessor (node.`metadata.`) after stripping only double quotes, without escaping embedded backticks.This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
Affected products and versions
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring AI
The 18 CVEs of Spring AI →
CVE-2026-59319
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values…
4.3
Medium
CVE-2026-59294
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without…
5.9
Medium
CVE-2026-47852
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file
7.5
High
CVE-2026-47851
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread
7.5
High