Spring AI loads models from a deterministic cache directory. An attacker with local write access on a shared host can pre-create a malicious ONNX file at that location. When the application later loads the cached model, it interprets the payload, allowing execution of arbitrary code within the Spring AI process's privileges. The flaw grants local code execution and potentially privilege escalation for the user running Spring AI, and is a CWE‑470 vulnerability.

The vulnerability affects Spring AI releases 2.0.0, 1.1.0–1.1.8, and 1.0.0–1.0.9 shipped by the Spring framework. Any deployment of these versions on a multi‑user host where the default global cache path is accessible to multiple users is affected.

The CVSS score of 7.5 reflects a high severity local threat. Exploitation requires only the ability to create or overwrite files in the known cache directory; there is no network component and the EPSS score is currently unavailable. The vulnerability is not present in the CISA KEV catalog. Attackers with local filesystem write access on a shared server can easily target the deterministic cache, so the risk is real for environments where Spring AI runs under a shared account or the cache directory is not properly contained.