A critical JSONPath injection vulnerability in Spring AI allows authenticated users to bypass critical access controls and gain unauthorized access to protected metadata or documents.

The flaw exists in the AbstractFilterExpressionConverter component, where user-supplied input is improperly concatenated into JSONPath queries without sufficient escaping. This allows an authenticated attacker to manipulate filter expressions to bypass multi-tenant isolation or role-based access controls.

The ability to bypass metadata-based access controls poses a significant risk to data confidentiality, particularly in multi-tenant environments where strict logical separation is required. An attacker could query unauthorized documents or retrieve restricted metadata, potentially leading to a massive data breach or failure of compliance requirements. With a CVSS score of 8.6, this high-severity vulnerability warrants immediate attention to prevent unauthorized information disclosure.

Immediate Action: Update the Spring AI library to versions 1.0.4 or 1.1.3, as specified in the vendor security advisory, to incorporate the necessary input sanitization patches.

Proactive Monitoring: Monitor application logs for unusual query patterns, specifically looking for JSONPath-related characters such as quotes, pipes, or ampersands within metadata filter parameters.

Compensating Controls: Implement strict input validation on the application layer for any user-provided metadata filter strings and utilize Web Application Firewall rules to block requests containing anomalous JSONPath syntax.

Public Exploit Available: Unknown.

Given the potential for unauthorized data access in sensitive multi-tenant or role-restricted environments, organizations should treat this vulnerability with high urgency. Administrators must prioritize updating the Spring AI dependency to the patched versions immediately to ensure that metadata-based isolation is correctly enforced.