Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreRediSearch Query via Unescaped TAG Filter Values in RedisVectorStore
Description
In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field,
stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping characters.
Affected Spring Products and Versions
Spring AI:
- 1.1.0 - 1.1.3
- 1.0.0 - 1.0.4
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 1.1.4 | OSS |
| 1.0.5 | OSS |
No further mitigation steps are necessary.
Credit
The issue was reported responsibly by Hyunwoo Kim (@V4bel)
History
- 2026-03-26: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all