https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:02:59 +0000 https://cve.radiocsirt.org/vuln/cve-2026-22729 <p><strong>Affected:</strong> VMware Spring AI</p> <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> <p><strong>Affected:</strong> VMware Spring AI</p> <p>A JSONPath injection vulnerability in Spring AI&#39;s AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.</p> <p>This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.</p> <p>The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like &#34;, ||, and &amp;&amp; are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.</p> https://cve.radiocsirt.org/vuln/cve-2026-22729