Skip to main content

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

CVE-2026-41705

High
8.6/10

Summary

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI milvus-store prior to 1.0.7 and 1.1.0-M1 prior to 1.1.6. Spring AI typesense-store prior to 1.0.7 and 1.1.0-M1 prior to 1.1.6.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • LOW

CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

References

Advisory Timeline

  • Published