Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713) - ATR-2026-00450 (1a07ffbc-e3e2-5944-8bee-34755cbeefbf)
Detects exploitation of CVE-2026-41713 (High), memory poisoning via Spring AI's PromptChatMemoryAdvisor. The vulnerable pipeline persists user input into ChatMemory before any policy/safety check; subsequent retrievals re-inject the poisoned content into the LLM prompt as trusted prior turns. An attacker plants persistence-aware payloads ("IGNORE PREVIOUS INSTRUCTIONS once stored", "[SYSTEM-MEMORY-PERSIST]", role-override markers like "SYSTEM:" / "ASSISTANT:" inside a user turn, "REMEMBER:" directives, or explicit "from now on you are" reframing) so that every later turn — even from a different user session if combined with CVE-2026-41712 — receives an attacker-shaped system prompt. This rule detects the LLM-output / user-input payload shapes that signal memory-poisoning intent at the moment the advisor is writing to ChatMemory. CWE-94 (Code Injection), CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Patches in Spring AI >= 1.0.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch by catching the poisoning payload shape regardless of upstream patch state.