Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2026-22729 is a high-severity Expression Language Injection (CWE-917) vulnerability in Vmware Spring Ai. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as NLP and Transformers; in the Data-Related Vulnerabilities risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22729 is a JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter. The issue arises when user-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, allowing injection of arbitrary JSONPath logic. Special characters such as ", ||, and && are passed through unescaped, enabling attackers to alter intended query semantics and bypass metadata-based access controls. This affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.
Authenticated users can exploit the vulnerability by crafting filter expressions with malicious input, injecting JSONPath logic to access unauthorized documents. The attack requires no special privileges beyond authentication, operates over the network with low complexity, and results in high confidentiality impact through scoped access to sensitive data, as reflected in its CVSS v3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). It is classified under CWE-917 (XML Injection, analogous to expression injection).
The Spring security advisory provides details on mitigation and patches at https://spring.io/security/cve-2026-22729, published on 2026-03-18.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12795
Vulnerability Data
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic…
more
and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
- CWE(s)
AI Security AnalysisAI
- AI Category
- NLP and Transformers
- Risk Domain
- Data-Related Vulnerabilities
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2V1.3.5V4.3.1
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires checking and neutralizing special elements in externally influenced data before it is used to build executable statements such as EL expressions.
Security engineering principles include requirements for safe construction and sanitization of dynamic statements, structurally preventing expression-language injection at design time.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and safe EL construction to prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect EL injection but does not itself implement the fix.
Secure SDLC mandates input validation and output encoding that directly prevent expression-language injection.
Application security requirements explicitly call for controls against injection flaws including EL injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.
Secure coding standards require proper escaping and parameterization of expression-language statements.