CVE-2026-41705highCWE-917

CVE-2026-41705: falha de alta gravidade em Spring AI

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring AI+ Monitorar org.springframework.ai:spring-ai-milvus-store

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
Spring · Spring AI
CVEs relacionadas — Spring AI

No mesmo produto, das mais perigosas para as menos.

CVE-2026-22738CRITICALSpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code ExecutionEPSS 1.1%CVE-2026-59279HIGHUnbounded persistent session allocation via repeated initialize requestsEPSS 0.5%CVE-2026-47851HIGHUnbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderEPSS 0.5%CVE-2026-41863MEDIUMLLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APIEPSS 0.4%CVE-2026-40967HIGHCVE-2026-40967EPSS 0.4%CVE-2026-59294MEDIUMArbitrary File Write via Path Traversal in ResourceCacheServiceEPSS 0.4%