A vulnerability, which was classified as problematic, was found in Vmware Spring AI up to 1.0.5/1.1.4. Affected by this vulnerability is the function TransformersEmbeddingModel of the component ONNX Model Handler. Such manipulation leads to insecure temporary file. This vulnerability is uniquely identified as CVE-2026-40979. Local access is required to approach this attack.
| Vendor | Product | Versions |
|---|---|---|
| spring | spring ai | maven/org.springframework.ai:spring-ai-transformers: >= 1.0.0, < 1.0.6, maven/org.springframework.ai:spring-ai-transformers: >= 1.1.0, < 1.1.5 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| maven | org.springframework.ai:spring-ai-transformers | GHSA | 85% |
Updated vendor to VMware, added detailed description about the vulnerability, and clarified that no exploit exists.
Initial creation
