{"action":"Upgrade org.springframework.ai:spring-ai-neo4j-store to 1.0.5 (1.0.x) or 1.1.4 (1.1.x) or later.","affected":[{"fixed":"1.0.5","introduced":"1.0.0-M5"},{"fixed":"1.1.4","introduced":"1.1.0-M1"}],"component":"org.springframework.ai:spring-ai-neo4j-store","cve_ids":["CVE-2026-22743"],"ecosystem":"Maven","exploited":false,"fixed_versions":["1.0.5","1.1.4"],"ghsa_id":"GHSA-7cj7-rcw6-p68v","id":"tcs_01M5N8J49SWBWC2GCGHBD7SEXT","modified_at":"2026-03-29T15:56:27.273962Z","published_at":"2026-03-27T06:31:43Z","references":["https://osv.dev/vulnerability/GHSA-7cj7-rcw6-p68v","https://nvd.nist.gov/vuln/detail/CVE-2026-22743","https://github.com/spring-projects/spring-ai/commit/3a46c7dd00e4adc17a132b9438149bde94da244f","https://github.com/spring-projects/spring-ai","https://github.com/spring-projects/spring-ai/releases/tag/v1.0.5","https://github.com/spring-projects/spring-ai/releases/tag/v1.1.4","https://spring.io/security/cve-2026-22743"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7cj7-rcw6-p68v","url":"https://osv.dev/vulnerability/GHSA-7cj7-rcw6-p68v"}],"summary":"Spring AI has a Cypher Injection vulnerability in Neo4jVectorFilterExpressionConverter"}