Description

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

The application is vulnerable if all conditions below are true:

1. Defines an @Query or @Aggregation annotated repository method using a capture all placeholder as in @Query("?0") or @Query(":#{?0}").
2. Exposes that method to untrusted input (e.g., via spring-data-rest or custom web endpoint)
3. Passes unsanitized user input directly to the method.

Affected Spring Products and Versions

Spring Data MongoDB:

• 5.0.0 to 5.0.5
• 4.5.0 to 4.5.11
• 4.4.0 to 4.4.14
• 4.3.0 to 4.3.16
• 4.2.0 to 4.2.15
• 4.1.0 to 4.1.14
• 4.0.0 to 4.0.15
• 3.4.0 to 3.4.19
• older unsupported versions

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1

History

• 2026-06-09: Initial vulnerability report published.