https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:31:39 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0305 certfr-2026-avi-0305 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0305 https://cve.radiocsirt.org/vuln/euvd-2026-276461 EUVD-2026-276461 https://cve.radiocsirt.org/vuln/euvd-2026-276461 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22729 <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22729 https://cve.radiocsirt.org/vuln/ghsa-rp9g-qx29-88cp <p><strong>Affected:</strong> Maven: org.springframework.ai:spring-ai-vector-store</p> <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> <p><strong>Affected:</strong> Maven: org.springframework.ai:spring-ai-vector-store</p> <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> https://cve.radiocsirt.org/vuln/ghsa-rp9g-qx29-88cp