This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) within Spring AI's CosmosDBVectorStore. It allows an attacker with low privileges to inject arbitrary SQL queries via crafted document IDs, potentially compromising the database. The issue affects Spring AI versions 1.0.0 to 1.0.5 and 1.1.0 to 1.1.4. The vendor has fixed the vulnerability in versions 1.0.6 and 1.1.5. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to unauthorized disclosure, modification, or deletion of data within the affected database, severely impacting confidentiality, integrity, and availability. The vulnerability requires only low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits have been reported in the wild to date.

Upgrade affected Spring AI versions to 1.0.6 or 1.1.5, where the vulnerability has been fixed. Since this is a product vulnerability with official fixes released, applying these updates is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.