Spring AI vulnerabilities

RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Affects Spring AI 2.0.0.

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier.

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.

Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.

In Spring AI versions 1.1.0 through 1.1.x, support for Anthropic's Skills API uses LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.

Vulnerability in Spring AI's MilvusVectorStore#doDelete(List) implementation allows filter-expression injection via unsanitized document IDs. Affects Spring AI 1.0.x (up to 1.0.7) and 1.1.x (up to 1.1.6).

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper. Affected versions are 1.0.0-1.0.5 (fixed in 1.0.6) and 1.1.0-1.1.4 (fixed in 1.1.5).

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: 1.0.0–1.0.5 (fixed in 1.0.6) and 1.1.0–1.1.4 (fixed in 1.1.5).

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users' chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.