This vulnerability involves improper neutralization of special elements used in an Expression Language statement (CWE-917) within Spring Data KeyValue. Specifically, when user input is passed unsanitized as a Sort parameter into repository query methods, it is evaluated by the SpelPropertyComparator, allowing potential injection of malicious SpEL expressions. The affected versions include Spring Data KeyValue and Spring Data Redis versions 2.7.0 through 2.7.19, 3.0.0 through 3.0.15, 3.1.0 through 3.1.14, 3.2.0 through 3.2.15, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could lead to high confidentiality impact, low integrity impact, and low availability impact. This means an attacker could potentially access sensitive information due to the injection of malicious expressions but with limited ability to alter data or disrupt service significantly. The CVSS vector indicates the attack requires network access, high attack complexity, low privileges, and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing unsanitized user input as Sort parameters in repository query methods that use SpelPropertyComparator. Implement input validation and sanitization to neutralize special characters in user input before it reaches the expression evaluation context.