Spring AI MilvusVectorStore Filter-Expression Injection Vulnerability in doDelete Implementation
Vulnerability
A filter-expression injection vulnerability has been identified in the doDelete method of Spring AI's MilvusVectorStore. This issue arises from the use of unsanitized document IDs, which can be exploited to inject malicious filter expressions. The vulnerability affects Spring AI versions 1.0.0 through the latest 1.0.x release, as well as versions 1.1.0 through the latest 1.1.x release.
Impact
Exploitation of this vulnerability allows for unauthorized filter-expression injection, which could lead to unintended data deletion or manipulation.
Remediation
Users should upgrade to Spring AI version 1.0.7 or 1.1.6, depending on their current version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.