What is the CVSS score of EUVD-2026-17985?

EUVD-2026-17985 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by EUVD-2026-17985?

CVE-2026-34445 affects ONNX Python library versions before 1.21.0, enabling unauthenticated attackers to inject arbitrary attributes into model objects through specially crafted ONNX files,…. A patch is available.

How to fix or mitigate EUVD-2026-17985?

Within 24 hours: Inventory all systems running ONNX Python library and identify versions prior to 1.21.0; document which systems process untrusted or externally-sourced ONNX model files. Within 7 days: Implement input validation and file source restrictions to limit ONNX model processing to trusted, internally-controlled sources only; establish monitoring for unexpected attribute modifications in ONNX object deserialization. Within 30 days: Monitor vendor advisories for patch release to ONNX 1.21.0 or later and execute update across all affected systems; conduct code review of any custom ONNX processing logic for similar attribute injection risks.

Python EUVD-2026-17985

| CVE-2026-34445 HIGH

Improper Input Validation (CWE-20)

2026-04-01 GitHub_M

GHSA-538c-55jv-c5g9

Python Microsoft Information Disclosure Red Hat Suse

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SUSE

HIGH

qualitative

Red Hat

7.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 18:15 euvd

EUVD-2026-17985

Analysis Generated

Apr 01, 2026 - 18:15 vuln.today

CVE Published

Apr 01, 2026 - 17:30 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

17 pypi packages depend on onnx (9 direct, 8 indirect)

Ecosystem-wide dependent count for version 1.21.0.

DescriptionGitHub Advisory

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

AnalysisAI

Arbitrary attribute injection in ONNX Python library (versions prior to 1.21.0) allows unauthenticated remote attackers to manipulate internal object properties by embedding malicious metadata in ONNX model files, resulting in potential information disclosure, data integrity violations, and high availability impact (CVSS 8.6). The vulnerability stems from unchecked use of Python's setattr() with externally-controlled keys during ExternalDataInfo deserialization. No public exploit code or CISA KEV listing identified at time of analysis, but proof-of-concept development is trivial given the straightforward nature of Python attribute manipulation. EPSS data not provided, but the unauthenticated network-accessible attack vector and low complexity suggest material risk for organizations processing untrusted ONNX models.

Technical ContextAI

ONNX is a widely-adopted open standard for representing machine learning models, enabling interoperability across frameworks like PyTorch, TensorFlow, and scikit-learn. The vulnerability resides in the ExternalDataInfo class, which handles metadata for externally stored tensor data (file paths, offsets, data lengths). The implementation used Python's setattr(object, key, value) to dynamically assign attributes based on key-value pairs parsed directly from the ONNX protobuf model file without validating whether these keys correspond to legitimate metadata fields. This represents a classic CWE-20 (Improper Input Validation) flaw where untrusted data controls object state. An attacker crafting a malicious .onnx file can inject arbitrary attribute names, potentially overwriting critical internal properties like __class__, __dict__, or application-specific control flow variables. The affected CPE (cpe:2.3:a:onnx:onnx) covers the Python onnx package prior to version 1.21.0, used in ML pipelines for model conversion, validation, and inference deployment.

RemediationAI

Organizations must upgrade the ONNX Python package to version 1.21.0 or later, which implements input validation for ExternalDataInfo attribute keys per the patch commit e30c6935d67cc3eca2fa284e37248e7c0036c46b available at https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b. The fix is delivered through pull request 7751 (https://github.com/onnx/onnx/pull/7751) and restricts setattr() usage to a whitelist of legitimate metadata fields. For environments unable to immediately upgrade, implement strict input validation by scanning ONNX model files for unexpected metadata keys before deserialization, restrict model sources to trusted repositories with integrity verification, and deploy sandboxed execution environments with resource limits to contain potential availability impacts. Review the GitHub Security Advisory at https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9 for additional vendor guidance on detection and migration strategies.