CVE-2026-22738

nvd.nist.gov • August 7, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied input as a filter expression key are affected. This issue affects Spring AI: from 1.0.0 before 1.0.5, from 1.1.0 before 1.1.4.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Generated Security Patches Fail 74% of the Time, Study Reveals A recent study by 1Password's Off-by-1 Labs found that AI-generated patches for software vulnerabilities succeeded only 26% of the time. The research analyzed 6,080 patches created by AI models ChatGPT 5.5 and Claude Opus 4.8 for six complex vulnerabilities, including CVE-2026-31431 and CVE-2026-34197. Alarmingly, 74% of the patches were either incomplete or incorrect, raising concerns about the reliability of AI in critical security tasks. The study highlighted that many AI-generated fixes altered application behavior or introduced new vulnerabilities. As organizations increasingly adopt AI for vulnerability management, the findings suggest a pressing need for human oversight in the patching process. The research emphasizes that AI tools are not yet ready to autonomously handle complex security tasks without human intervention. 9 sources 69

Extracted Entities

CVE-2026-22738

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)