What is GHSA-cmwh-w62w-r2mf?

GHSA-cmwh-w62w-r2mf is a security advisory published by GitHub Security Advisories with High severity. In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary...

Which CVE IDs does GHSA-cmwh-w62w-r2mf cover?

GHSA-cmwh-w62w-r2mf covers the following CVE IDs: CVE-2026-47835. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cmwh-w62w-r2mf?

GHSA-cmwh-w62w-r2mf has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-cmwh-w62w-r2mfHighCVSS 8.6

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary...

Vendor

GitHub Security Advisories

Published

June 15, 2026

Last Modified

June 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-47835 →

📋 Description

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.

Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-47835
https://spring.io/security/cve-2026-47835
https://github.com/advisories/GHSA-cmwh-w62w-r2mf