A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. (CVE-2026-47852)

This vulnerability allows a local attacker on a multi-user system to pre-create the deterministic cache path used by Spring AI and plant a malicious ONNX model file. When the application loads the model from this cache, it may execute or use the malicious model, potentially leading to integrity violations. The CVSS 3.1 score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild or patch information is provided.

The vulnerability impacts the integrity of the Spring AI model loading process by allowing a local attacker to substitute a legitimate ONNX model with a malicious one. This can lead to execution or use of malicious models, potentially compromising application behavior or data integrity. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access on multi-user hosts to prevent unauthorized creation of cache paths and planting of malicious model files.