CVE-2026-47835

Published: Jun 15, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

Affected (2)

Products: Vmware: Spring Ai

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Ai	From 1.0.0 to 1.0.9
Vmware Spring Ai	From 1.1.0 to 1.1.8

Related CWEs

Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

References (1)

https://spring.io/security/cve-2026-47835

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.