This vulnerability arises from improper neutralization of special elements in Spring Expression Language (SpEL) statements within Spring Data KeyValue. Specifically, if unsanitized user input is passed as a Sort parameter into repository query methods, it delegates evaluation to SpelPropertyComparator, which can be exploited for SpEL Injection. Affected versions include Spring Data KeyValue and Spring Data Redis versions 2.7.0 through 2.7.19, 3.0.0 through 3.0.15, 3.1.0 through 3.1.14, 3.2.0 through 3.2.15, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, and 4.0.0 through 4.0.5. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to high confidentiality impact by exposing sensitive data, limited integrity impact by potentially manipulating expression evaluation, and limited availability impact. The vulnerability allows attackers with low privileges and no user interaction to exploit the system remotely over the network, but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing unsanitized user input as Sort parameters in repository query methods that use SpelPropertyComparator. Implement input validation and sanitization to mitigate potential injection risks.