Spring AI contains an expression language injection vulnerability in the MilvusVectorStore component that allows unauthenticated attackers to manipulate filter expressions and compromise backend integrity.

This is an improper neutralization of special elements used in an expression language statement, specifically CWE-917, triggered via unsanitized document IDs in the MilvusVectorStore#doDelete(List) method by unauthenticated users over the network.

A successful exploit allows attackers to execute arbitrary filter expressions, potentially leading to unauthorized data access, modification, or deletion within the vector database. With a CVSS score of 8.6, this high severity vulnerability poses significant risk to application confidentiality and integrity, particularly in environments handling sensitive vector embeddings and AI data stores.

Immediate Action: Update Spring AI components by upgrading spring-ai-milvus-store and spring-ai-typesense-store to version 1.0.7 or 1.1.6 respectively.

Proactive Monitoring: Monitor application logs for unusual document deletion patterns or anomalous inputs containing expression syntax characters within vector store API requests.

Compensating Controls: Deploy a Web Application Firewall with rules to inspect vector store API parameters for unexpected expression language syntax or injection payloads.

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in tracking data).

Organizations utilizing Spring AI must treat this high severity vulnerability with urgency due to the potential for remote filter manipulation. Apply the provided vendor updates immediately to affected Maven packages to mitigate potential exploitation risks.