Spring Security Advisories

RSS feed

SQL Injection in CosmosDBVectorStore.doDelete()

HIGH | APRIL 27, 2026 | CVE-2026-40978

Description

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs.

Only applications that use CosmosDBVectorStore and pass user-supplied input as document ids are affected.

Affected Spring Products and Versions

Spring AI:

  • 1.0.0 - 1.0.5
  • 1.1.0 - 1.1.4

Affected Spring Products and Versions

Spring AI:

  • 1.1.0 - 1.1.4
  • 1.0.0 - 1.0.5

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
1.1.5OSS
1.0.6OSS

No further mitigation steps are necessary.

Credit

The issue was reported responsibly by

  • SharlongWen

References

History

  • 2026-04-27: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all