Netron CVE-2026-79720

The victim must open a maliciously crafted ML model file (any Netron-supported format such as ONNX, TensorFlow SavedModel, Keras, or PyTorch) in Netron desktop application version 9.1.2 or earlier. No authentication, elevated privileges, or non-default configuration is required on the victim's machine - the vulnerable innerHTML assignments execute as part of normal model rendering for any opened file. Exploitation is bounded to local execution on the victim's workstation; there is no direct network-reachable attack surface. The RCE escalation path requires a separately available, unpatched Chromium/Electron n-day vulnerability at the time of attack; without that secondary vulnerability the impact is limited to XSS-level actions including port scanning and DOM manipulation within the Netron window.

The provided CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:N/UI:P) accurately reflects the local-file attack vector and passive user interaction requirement. However, the impact metrics VC:H/VI:N/VA:N appear to understate the worst-case scenario: the description explicitly claims RCE is achievable by chaining the XSS with a Chrome n-day, which would elevate integrity and availability impact significantly - this discrepancy should be noted by analysts applying the score. EPSS data is absent from the provided intelligence, and the CVE is not listed in the CISA KEV catalog, so exploitation probability in the wild is unconfirmed. The ML and AI toolchain is an increasingly high-value target: Netron users routinely work with sensitive model weights, training data pipelines, and environments containing API credentials and dataset access. The attack is automatable once a malicious file is delivered and requires no elevated privileges on the victim system, making it relevant wherever data scientists open externally sourced model files. The secondary RCE path via a Chrome n-day depends on a separate unspecified vulnerability, which introduces additional uncertainty into the severity ceiling.

An attacker crafts a malicious ONNX or other Netron-supported model file with an XSS payload embedded in a node name or attribute description field, then delivers it to a target data scientist through a shared model repository, email, or dataset distribution channel. When the victim opens the file in Netron 9.1.2 or earlier, the unsanitized payload executes in the Electron renderer, enabling immediate actions such as local port scanning for network reconnaissance or manipulation of the visible model graph. In a targeted attack against a specific victim environment, the payload could additionally chain with a known unpatched Chromium vulnerability to escape the renderer context and achieve full Remote Code Execution on the workstation.