com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: GHSA-CMWH-W62W-R2MF...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: OSV:GHSA-CMWH-W62W-R2MF...

CVE-2026-47835

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

ai.driftkit:driftkit-vector-spring-ai (>=0.6.0, <=0.9.2), ai.driftkit:driftkit-vector-spring-ai-starter (>=0.6.0, <=0.9.2) +195 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-vector-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.0.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 - com.alibaba.cloud.ai.autoconfigure.memory.long:spring-ai-alibaba-autoconfigure-memory-long 1.0.0.4 -...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.1.0, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...