Spring AI loads ONNX models from a deterministic cache directory. A local attacker with write permission to that directory can pre‑create a malicious ONNX file. When the application subsequently loads the cached model, the malicious content may be interpreted, potentially altering the model’s behavior. This vulnerability constitutes a CWE‑377 flaw that only requires local file system write access, without any network interaction.

The flaw affects versions 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9 of Spring AI, all released by the Spring framework. Any installation of these versions on a multi‑user system where the default global cache path is shared among users is vulnerable.

The CVSS score of 7.5 marks it as high severity. The EPSS score of <1% indicates a low but non‑zero chance that it will be exploited. The flaw is not listed in the CISA KEV catalog. Attackers need only local file‑system write rights to a deterministic cache path, so environments where Spring AI runs under a shared account or where the cache directory is not isolated remain at risk. The vulnerability can be exploited without network access, making the real‑world risk dependent on local access levels.