| Package | Affected versions | Patched versions |
|---|---|---|
| spring ai | ≥ 2.0.0, < 2.0.1 | 2.0.1 |
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free