CVE-2026-59319
Received
Received - Intake
RedisChatMemoryRepository Metadata Injection via Unescaped RediSearch Queries
Vulnerability report for CVE-2026-59319, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-27
Last updated on: 2026-08-27
Assigner: VMware
Description
Description
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index.
Spring AI 2.0.0
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_ai | to 2.0.0 (inc) |
| vmware | spring_ai | 2.0.1 |
| vmware | spring_ai | 2.0.0.1 |
| vmware | spring_ai | 2.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
