CyberRota Analysis
AI-GeneratedThe vulnerability exists in the RedisChatMemoryRepository.findByMetadata() method, which constructs RediSearch queries using unsanitized user input, unlike other methods in the same class that properly escape inputs. This oversight allows attackers to inject malicious RediSearch syntax, potentially exposing all indexed chat messages across conversations. Organizations utilizing Spring AI 2.0.0 should prioritize addressing this vulnerability to mitigate the risk of unauthorized data access.
Original NVD Description
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0
Related CVEs
Other vulnerabilities affecting the same vendor(s)