CVE-2018-1273: Spring Data Commons remote code injection vulnerability
Summary
CVE-2018-1273: Spring Data Commons remote code injection vulnerability. Affects org.springframework.data:spring-data-commons across 2 version ranges.
>= 1.13.0, < 1.13.11
>= 2.0.0, < 2.0.6
Fixed in 1.13.11 or 2.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data Commons is a library that provides a consistent and easy-to-use interface for accessing databases in the Spring Framework. It is commonly used in Java applications to simplify database operations and improve productivity. However, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions of Spring Data Commons are vulnerable to a remote code injection attack.
Vulnerability Detail
The vulnerability in Spring Data Commons is caused by improper neutralization of special elements, which allows an unauthenticated remote attacker to supply specially crafted request parameters that can lead to remote code execution. This vulnerability can be exploited by targeting Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding. If successfully exploited, an attacker can execute arbitrary code on the affected system, potentially compromising its security and integrity.
How To Fix
Latest published version: 4.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.13.0, < 1.13.111.13.11 -
>= 2.0.0, < 2.0.62.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by the Spring Data Commons project.
Conclusion
The Spring Data Commons remote code injection vulnerability (CVE-2018-1273) is a critical security issue that allows an unauthenticated remote attacker to execute arbitrary code on affected systems. It is crucial to upgrade to the fixed versions of Spring Data Commons and follow secure coding practices to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.data:spring-data-commons →
FAQ
Spring Data Commons is a library that provides a consistent and easy-to-use interface for accessing databases in the Spring Framework.
Versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions of Spring Data Commons are affected.
An attacker can exploit this vulnerability by supplying specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding.
If successfully exploited, an attacker can execute arbitrary code on the affected system, potentially compromising its security and integrity.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Spring Data Commons and follow secure coding practices.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-commons.
