External risk intelligence

Spring AI SimpleVectorStore SpEL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-22738

Spring AI is a library integrated into custom application code rather than a standalone edge service or gateway. While it may be used in internet-facing web applications to process user input, the vulnerability only manifests when developers specifically implement the SimpleVectorStore with unsanitized user-supplied filter keys, making public exposure dependent on specific, non-default application architecture.

Vmware Spring Ai

1.0.0 to before 1.0.51.1.0 to before 1.1.4

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Spring AI, a software library used for developing AI applications. This issue could allow a malicious actor to execute arbitrary code by exploiting how user-supplied data is processed within a specific component. The risk is limited to applications that use this component and pass unfiltered user input as a filter key.

Allows code execution through data input.
Matters if your applications use Spring AI.
Confirm relevance; widespread impact is unlikely.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request that includes malicious input as a filter expression key to an application using the affected `SimpleVectorStore` component. This allows the attacker to execute arbitrary code on the system.

No authentication or privileges required.
User-supplied input used as a filter key.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, applications using Spring AI's `SimpleVectorStore` with user-supplied filter expression keys could allow a malicious actor to execute arbitrary code by exploiting a SpEL injection vulnerability. This risk is present only in applications that specifically integrate this component and pass unsanitized user input as a filter key.

Arbitrary code execution.
User-supplied input used as filter key.
System compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are most likely to be responsible for addressing this vulnerability, as it affects the Spring AI library when used within custom applications. The initial step should be to identify all instances where Spring AI's `SimpleVectorStore` is utilized with user-supplied filter keys, assess their business criticality and network exposure, and then coordinate remediation with the accountable owners.

Identify affected application instances.
Verify `SimpleVectorStore` usage and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Spring AI and how is it used?

Spring AI is a software library designed to help developers build artificial intelligence and machine learning features into their Java applications. It acts as a bridge, simplifying the integration of AI models and vector databases into the standard Spring ecosystem, which developers use to create robust, backend-driven business software.

What is the vulnerability in CVE-2026-22738?

This vulnerability is a SpEL (Spring Expression Language) injection. It falls under the weakness classes CWE-917 and CWE-88. In simple terms, the software accidentally treats data provided by a user as executable code instead of just text, allowing an attacker to manipulate the program's logic to run unauthorized commands.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a request containing malicious input to an application that uses the SimpleVectorStore component. Crucially, the bug only activates if the application developer has written code that takes input directly from a user and passes it as a filter expression key. If the filter key is hardcoded or comes from a trusted internal source, it does not trigger the vulnerability.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal assesses this as having a 'Possible' likelihood because Spring AI is a library integrated into custom code rather than a standalone edge server. While internet-facing applications using the affected component are theoretically at higher risk, the actual exposure depends heavily on whether your specific custom application architecture allows user input to reach the vulnerable filter key function.

How should I respond to CVE-2026-22738?

Start by auditing your codebase to find where the SimpleVectorStore component is implemented. Specifically, look for points where external, user-supplied data is passed into filter expression keys. If you find such patterns, prioritize updating to the patched versions of the library (1.0.5 or 1.1.4 and later) and ensure that all user input is properly sanitized before being used in filters.

References

spring.io/security/cve-2026-22738

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.