Spring AI ONNX Model Exposure Vulnerability

A vulnerability in Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4 allows exposure of the ONNX model used by the application. This issue arises when applications utilize the 'TransformersEmbeddingModel' with caching enabled, defaulting to a world-writable and predictable temporary directory. Access to a shared environment can further exacerbate the problem.

Impact

Exploitation of this vulnerability can lead to unauthorized access to the ONNX model, potentially allowing for misuse or manipulation of the model within the application.

Remediation

Users should upgrade to Spring AI version 1.0.6 or 1.1.5, depending on their current version. No additional mitigation steps are necessary.