io.gitee.yeshizhe:echoparrot-application (25.2.5), io.gitee.yeshizhe:echoparrot-core (25.2.5) +2 more potentially affected by CVE-2026-22743 via org.springframework.ai:spring-ai-neo4j-store (>=1.0.0-m5, <=1.0.4)

org.springframework.ai:spring-ai-neo4j-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.4 Source cves: CVE-2026-22743 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-15791530...

io.gitee.yeshizhe:echoparrot-application (25.2.5), io.gitee.yeshizhe:echoparrot-core (25.2.5) +2 more potentially affected by CVE-2026-22743 via org.springframework.ai:spring-ai-neo4j-store (>=1.0.0-m5, <=1.0.4)

org.springframework.ai:spring-ai-neo4j-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.4 Source cves: CVE-2026-22743 Source advisory: GHSA-7CJ7-RCW6-P68V...

CVE-2026-22743 Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store, doKey embeds the key into a backtick-delimited...

io.gitee.yeshizhe:echoparrot-application (25.2.5), io.gitee.yeshizhe:echoparrot-core (25.2.5) +2 more potentially affected by CVE-2026-22743 via org.springframework.ai:spring-ai-neo4j-store (>=1.0.0-m5, <=1.0.4)

org.springframework.ai:spring-ai-neo4j-store MAVEN version =1.0.0-m5, =1.0.0-m5, =1.0.0-m7, =1.0.4 Source cves: CVE-2026-22743 Source advisory: MEND:CVE-2026-22743...

CVE-2026-22743

creationtimestamp| type| source ---|---|--- 2026-03-26 20:05:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-288 2026-03-27 07:18:31+00:00| seen| Telegram/tQ8akL20JB-7ffGjDDpJsYVoTg18MfzS3yyGF6GBW7nNPwo 2026-03-27 08:14:21+00:00| seen|...