Spring AI Redis Store Unescaped TAG Filter Value Vulnerability in RediSearch

A vulnerability exists in the `spring-ai-redis-store` component of Spring AI versions 1.0.0 prior to 1.0.5 and 1.1.0 prior to 1.1.4. The issue arises in the `RedisFilterExpressionConverter`, where user-controlled strings can be passed as filter values for TAG fields. The `stringValue()` method then inserts these values directly into the RediSearch TAG block without proper character escaping. This flaw could potentially be exploited to manipulate RediSearch queries by injecting unescaped data into TAG fields.

Impact

Exploitation of this vulnerability allows for injection of unescaped strings into RediSearch TAG fields, which could be used to manipulate query behavior or introduce unexpected results.

Remediation

Users should upgrade to Spring AI version 1.0.5 or 1.1.4, depending on their current version.