---
id: CVE-2026-47852
title: >-
  A local attacker on a multi-user host can pre-create the deterministic cache
  path and plant a malicious ONNX model file.

  Spring AI 2.0.0

  Spring AI 1.1.0 - 1.1.8

  Spring AI 1.0.0 - 1.0.9
summary: >-
  A local attacker on a multi-user host can pre-create the deterministic cache
  path and plant a malicious ONNX model file.

  Spring AI 2.0.0

  Spring AI 1.1.0 - 1.1.8

  Spring AI 1.0.0 - 1.0.9
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-377
vendor: vmware
product: spring_ai
affected:
  - 'spring_ai >= 1.0.0, < 1.0.10'
  - 'spring_ai >= 1.1.0, < 1.1.9'
  - 'spring_ai >= 2.0.0, < 2.0.0.1'
patched:
  - spring_ai 2.0.0.1
published: '2026-08-27'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47852'
references:
  - url: 'https://spring.io/security/cve-2026-47852'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00347
epssPercentile: 0.25612
ingestedAt: '2026-09-05T19:43:56.014Z'
---

## Overview

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1.8
Spring AI 1.0.0 - 1.0.9

## Affected

- `spring_ai >= 1.0.0, < 1.0.10`
- `spring_ai >= 1.1.0, < 1.1.9`
- `spring_ai >= 2.0.0, < 2.0.0.1`

## Remediation

Upgrade past the affected range:

- `spring_ai 2.0.0.1`