Vulnerability Description
Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey() embeds the key into a backtick-delimited Cypher property accessor (node.`metadata.`) after stripping only double quotes, without escaping embedded backticks.This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Ai | >= 1.0.0, < 1.0.5 |
Related Weaknesses (CWE)
References
- https://spring.io/security/cve-2026-22743Vendor Advisory
FAQ
What is CVE-2026-22743?
CVE-2026-22743 is a vulnerability with a CVSS score of 7.5 (HIGH). Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFi...
How severe is CVE-2026-22743?
CVE-2026-22743 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22743?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Spring Ai.