{"action":"Upgrade org.springframework.ai:spring-ai-anthropic to 1.1.7 or later.","affected":[{"fixed":"1.1.7","introduced":"1.1.0"}],"component":"org.springframework.ai:spring-ai-anthropic","cve_ids":["CVE-2026-41863"],"ecosystem":"Maven","epss":0.00398,"exploited":false,"fixed_versions":["1.1.7"],"ghsa_id":"GHSA-cc4m-mp48-x7qg","id":"tcs_01M5N8S3PRHMCYTT3JDV0NA6MK","modified_at":"2026-06-30T17:11:33.752121Z","published_at":"2026-05-26T13:30:39Z","references":["https://osv.dev/vulnerability/GHSA-cc4m-mp48-x7qg","https://nvd.nist.gov/vuln/detail/CVE-2026-41863","https://github.com/spring-projects/spring-ai","https://spring.io/security/cve-2026-41863"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cc4m-mp48-x7qg","url":"https://osv.dev/vulnerability/GHSA-cc4m-mp48-x7qg"}],"summary":"Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk"}