{"data":{"id":"423f62ba-9a1e-4925-bc01-92f835e41372","title":"CVE-2026-40979: In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected version…","summary":"CVE-2026-40979 affects Spring AI, where access to a shared environment can expose the ONNX model the application uses. Affected versions are 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4, with CWE-377 (Insecure Temporary File) listed as the weakness. NVD has not yet provided an assessment.","solution":"Fixed in 1.0.6 (for 1.0.x) and 1.1.5 (for 1.1.x).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40979","publishedAt":"2026-04-28T09:16:16.767Z","cveId":"CVE-2026-40979","cweIds":["CWE-377"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["org.springframework.ai:spring-ai-transformers@>= 1.0.0, < 1.0.6 (fixed: 1.0.6)","org.springframework.ai:spring-ai-transformers@>= 1.1.0, < 1.1.5 (fixed: 1.1.5)"],"affectedPackageNames":["org-springframework-ai:spring-ai-transformers"],"affectedPackageRefs":["maven:org-springframework-ai:spring-ai-transformers"],"affectedVendors":[],"affectedVendorsRaw":["Spring AI","ONNX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Spring AI exposes ONNX model to access through shared environment","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00105,"epssCheckedAt":"2026-11-09T12:10:45.242Z","kevDateAdded":null,"advisoryAliases":["GHSA-r5hp-3cgj-j6xv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:49:04.324Z","patchAvailable":true,"disclosureDate":"2026-04-28T09:16:16.767Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T06:09:53.035Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"org.springframework.ai:spring-ai-transformers","fixedVersion":"1.1.5","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T06:09:53.031Z"},{"ecosystem":null,"name":"org.springframework.ai:spring-ai-transformers","fixedVersion":"1.0.6","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-11-06T06:09:53.031Z"}]}}