MEDIUM 6.5
GHSA-cc4m-mp48-x7qg
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk
상세
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.
Affected versions: Spring AI: 1.1.0 through 1.1.7
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Maven / org.springframework.ai:spring-ai-anthropic
최초 영향 버전:
1.1.0 수정 버전: 1.1.7 수정
# pom.xml: bump <version>1.1.7</version> for org.springframework.ai:spring-ai-anthropic