{"data":{"id":"210d46a4-1efd-47aa-b610-1cf82f7781ca","title":"CVE-2026-41705: Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via…","summary":"CVE-2026-41705 affects Spring AI's MilvusVectorStore#doDelete(List) implementation, which is vulnerable to filter-expression injection through unsanitized document IDs. It is classified under CWE-917, Improper Neutralization of Special Elements used in an Expression Language Statement. NVD published the entry on 05/08/2026, and NVD has not yet provided an assessment.","solution":"Spring AI 1.0.x: upgrade to 1.0.7 or greater. Spring AI 1.1.x: upgrade to 1.1.6 or greater.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41705","publishedAt":"2026-05-09T01:16:08.690Z","cveId":"CVE-2026-41705","cweIds":["CWE-917"],"cvssScore":"8.6","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["org.springframework.ai:spring-ai-milvus-store@>= 1.0.0, < 1.0.7 (fixed: 1.0.7)","org.springframework.ai:spring-ai-milvus-store@>= 1.1.0, < 1.1.6 (fixed: 1.1.6)","org.springframework.ai:spring-ai-typesense-store@>= 1.0.0, < 1.0.7 (fixed: 1.0.7)","org.springframework.ai:spring-ai-typesense-store@>= 1.1.0, < 1.1.6 (fixed: 1.1.6)"],"affectedPackageNames":["org-springframework-ai:spring-ai-milvus-store","org-springframework-ai:spring-ai-typesense-store"],"affectedPackageRefs":["maven:org-springframework-ai:spring-ai-milvus-store","maven:org-springframework-ai:spring-ai-typesense-store"],"affectedVendors":[],"affectedVendorsRaw":["Spring AI","Milvus"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Spring AI MilvusVectorStore filter-expression injection in delete","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00353,"epssCheckedAt":"2026-11-08T12:09:01.373Z","kevDateAdded":null,"advisoryAliases":["GHSA-v632-2m87-7469"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:42.452Z","patchAvailable":true,"disclosureDate":"2026-05-09T01:16:08.690Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T00:07:45.772Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"org.springframework.ai:spring-ai-typesense-store","fixedVersion":"1.1.6","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T00:07:45.769Z"},{"ecosystem":null,"name":"org.springframework.ai:spring-ai-typesense-store","fixedVersion":"1.0.7","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T00:07:45.769Z"},{"ecosystem":null,"name":"org.springframework.ai:spring-ai-milvus-store","fixedVersion":"1.1.6","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T00:07:45.769Z"},{"ecosystem":null,"name":"org.springframework.ai:spring-ai-milvus-store","fixedVersion":"1.0.7","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T00:07:45.769Z"}]}}