Executive brief
Spring AI, a framework for building AI-powered applications in Java, creates a predictable cache directory for downloaded ONNX machine learning models. A local attacker on a shared host can pre-create this directory and plant a malicious model file, causing the application to load and execute untrusted code, leading to arbitrary code execution within the application context.
Technical details
This vulnerability stems from insecure use of a deterministic cache path for storing ONNX model files without proper validation or atomic creation mechanisms. A local attacker can pre-create the cache directory with a malicious ONNX model file before the Spring AI application runs. Since ONNX model deserialization can lead to code execution, loading a malicious model results in arbitrary code execution with the privileges of the application process. The attack requires local file system access on a multi-user host but no authentication or network access. Affected versions are Spring AI 1.0.0–1.0.9, 1.1.0–1.1.8, and 2.0.0.
Affected products
- Pivotal/VMware Spring AI 1.0.0–1.0.9, 1.1.0–1.1.8, 2.0.0
Timeline
- 2026-08-27: disclosed