Описание
SQL Injection in Spring AI MariaDBFilterExpressionConverter
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.
The vulnerability exists due to missing input sanitization.
Пакеты
org.springframework.ai:spring-ai-mariadb-store
>= 1.1.0-M1, < 1.1.3
1.1.3
org.springframework.ai:spring-ai-mariadb-store
< 1.0.4
1.0.4
Связанные уязвимости
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
Уязвимость компонента MariaDBFilterExpressionConverter фреймворка для разработки моделей искусственного интеллекта Spring AI, позволяющая нарушителю выполнить произвольные SQL-команды