Spring AI VectorStore FilterExpression Injection

Defending RAG Metadata Filters from Query Alteration

VMware disclosed an injection vulnerability in Spring AI's FilterExpression conversion logic affecting all vector store integrations. Keys and values in metadata filter expressions were not properly escaped before being converted into vector store query languages, allowing user-controlled input to alter the structure and semantics of retrieval queries. RAG pipelines, semantic search endpoints, and agent memory layers built on Spring AI 1.0.0–1.0.5 or 1.1.0–1.1.4 are affected. The risk: unauthorized document retrieval, context poisoning, and authorization bypass in multi-tenant deployments.

"RAG filters are security boundaries when they control which documents reach the model."

— VMware Spring AI Security Advisory