CVE-2026-40967 | Vmware Spring AI up to 1.0.5/1.1.4 Expressions FilterExpressionConverter code injection

A vulnerability, which was classified as critical, was found in Vmware Spring AI up to 1.0.5/1.1.4. This affects the function FilterExpressionConverter of the component Expressions Handler. The manipulation results in code injection.

This vulnerability was named CVE-2026-40967. The attack may be performed from remote. There is no available exploit.

You should upgrade the affected component.