{"id":"CVE-2026-47852","aliases":["CLSA-2026-1793463667","CLSA-2026-1793654179","EUVD-2026-66822","GHSA-cmjm-96ff-348r"],"status":"published","title":"Predictable cache directory location allows local ONNX model substitution in Spring AI","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00347,"percentile":0.2859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-377"],"published":"2026-08-26T23:28:42Z","modified":"2026-11-03T02:45:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4}],"products":[{"vendor":"spring","product":"spring ai"},{"vendor":"vmware","product":"spring ai"},{"vendor":"vmware","product":"spring_ai"}],"references":[{"url":"https://spring.io/security/cve-2026-47852","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47852","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cmjm-96ff-348r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47852.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47852","title":"Predictable cache directory location allows local ONNX model substitution in Spring AI","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:42.767Z","modified":"2026-08-27T15:13:55.925Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T13:36:29.327819Z"}],"euvd":[{"id":"EUVD-2026-66822","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:42Z","modified":"2026-08-27T15:13:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:27.663452Z"}],"ghsa":[{"id":"GHSA-cmjm-96ff-348r","title":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a...","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-27T03:32:58Z","modified":"2026-08-27T18:32:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:11:03.315113Z"}],"nvd":[{"id":"CVE-2026-47852","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-27T01:17:32.32Z","modified":"2026-09-04T20:08:46.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-47852","title":"Predictable cache directory location allows local ONNX model substitution in Spring AI","description":"A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.0 - 1.0.9","status":"published","published":"2026-08-26T23:28:42.767Z","modified":"2026-10-28T02:30:32.660978988Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1793463667","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.0.9-tuxcare.1.","status":"published","published":"2026-10-31T17:21:08Z","modified":"2026-11-02T19:46:33.281908979Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793654179","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.1.8-tuxcare.1.","status":"published","published":"2026-11-02T22:16:19Z","modified":"2026-11-03T02:45:02.358314545Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}