CVE-2026-47852

Analyzed Analyzed - Analysis Complete

Arbitrary File Write in Spring AI via Malicious ONNX Model

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47852

EUVD

EUVD-2026-66822

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_ai	From 1.0.0 (inc) to 1.0.10 (exc)
vmware	spring_ai	From 1.1.0 (inc) to 1.1.9 (exc)
vmware	spring_ai	From 2.0.0 (inc) to 2.0.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

This vulnerability in Spring AI allows a local attacker on a multi-user system to pre-create a predictable cache directory path and plant a malicious ONNX model file. This could lead to unauthorized model execution or data compromise.

Detection Guidance

Check for unexpected ONNX model files in Spring AI cache directories. Inspect paths like ~/.cache/spring-ai or /tmp/spring-ai for suspicious files. Verify file permissions and ownership of cache directories to detect unauthorized pre-creation.

Impact Analysis

An attacker could exploit this to replace a legitimate ONNX model with a malicious one, potentially executing unauthorized code or accessing sensitive data. The impact is high on integrity but does not affect confidentiality or availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized model execution or data compromise on multi-user systems. The integrity impact (I:H) suggests that malicious model files could alter data or system behavior without detection, which may violate integrity requirements in these regulations.

Mitigation Strategies

Upgrade to fixed versions of Spring AI: 2.0.1 (OSS), 2.0.0.1 (Enterprise-only), 1.1.9 (Enterprise-only), or 1.0.10 (Enterprise-only). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-47852. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70