CVE-2026-41729 describes a vulnerability in Spring Data REST where SpEL (Spring Expression Language) injection is possible through map-typed properties when handling JSON Patch (application/json-patch+json) requests. Specifically, if a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is directly embedded into a SpEL expression without any sanitization or validation, leading to improper neutralization of special elements (CWE-917). This allows an attacker with at least low privileges (PR:L) to execute arbitrary expressions, potentially compromising confidentiality and integrity without requiring user interaction. The vulnerability affects multiple version ranges from 3.7.0 up to 5.0.5.

Successful exploitation can lead to high impact on confidentiality and integrity of the affected system, as arbitrary SpEL expressions can be injected and executed. Availability is not impacted. The vulnerability requires network access and low privileges but no user interaction. This can allow attackers to manipulate application behavior or access sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid exposing map-typed properties in persistent entities to untrusted JSON Patch requests or implement strict input validation and sanitization on JSON Pointer path segments used as map keys.