Description

RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T20:17:57.913Z",
  "pubdate": "2026-08-27T20:17:57.913Z",
  "executiveSummary": "A RediSearch injection vulnerability exists in Spring AI 2.0.0, specifically within the RedisChatMemoryRepository class.\nThe vulnerability arises from improper input sanitization when constructing queries within the findByMetadata() function.\nUnlike other repository methods that utilize RediSearchUtil.escape(), findByMetadata() fails to sanitize caller-supplied metadata values before embedding them into RediSearch tag and text queries.\nThis flaw allows an authenticated attacker to inject arbitrary RediSearch syntax, potentially leading to unauthorized data exposure.\nBy manipulating the tag-typed metadata fields, an attacker can break out of the intended query clause, resulting in a query that matches all indexed chat messages across all conversations, regardless of the intended scoping.\nThe risk is significant as it compromises the confidentiality of stored chat memories within the Redis-backed implementation.",
  "technicalDetails": "The vulnerability is located in the findByMetadata() method within the RedisChatMemoryRepository class of Spring AI 2.0.0. The root cause is a lack of input sanitization during the construction of RediSearch queries.\nWhile the repository correctly employs RediSearchUtil.escape() in methods such as get(), clear(), and findByTimeRange() to sanitize inputs, this protective measure is omitted in findByMetadata().\nRediSearch queries, particularly those targeting tag fields, utilize specific syntax (e.g., curly braces '{}') to define query constraints. When user-supplied metadata is concatenated directly into these query strings without escaping, an attacker can inject malicious RediSearch control characters.\nExploitation involves passing a crafted payload via the metadata parameter that includes RediSearch operators, such as 'x} | *'.\nThe attack flow proceeds as follows: 1) The attacker provides a metadata input containing RediSearch syntax characters; 2) The findByMetadata() method builds the query string by embedding this malicious input directly; 3) The Redis database executes the modified query, where the injected syntax escapes the intended tag clause; 4) The resulting query broadens its scope, effectively ignoring the expected filters and matching all indexed chat messages.\nThis behavior allows an attacker to bypass intended conversation-level scoping, leading to the unauthorized disclosure of sensitive chat history. The vulnerability is exploitable by any user capable of influencing the metadata values passed to the affected method, provided they have access to the application interface that triggers this database lookup.\nNo authentication or specific privilege level is strictly required if the application exposes the metadata-filtering capability to end users. The network exposure is limited to the extent that the application's search functionality is reachable, and the post-exploitation impact involves the unauthorized exfiltration of chat data belonging to other users or sessions."
}