Description

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters.

Affected Spring Products and Versions

Spring AI:

• 1.0.0 - 1.0.x
• 1.1.0 - 1.1.x

Affected component: spring-ai-redis-store

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

The issue was reported responsibly by Hyunwoo Kim (@V4bel)

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1

History