EUVD-2026-17987
GHSA-cmw6-hcpp-c6jp
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4Blast Radius
ecosystem impact- 24 pypi packages depend on onnx (14 direct, 10 indirect)
Ecosystem-wide dependent count for version 1.21.0.
DescriptionGitHub Advisory
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
AnalysisAI
ONNX versions prior to 1.21.0 allow local attackers to read arbitrary files by exploiting a hardlink-based path traversal vulnerability in onnx.load(). The vulnerability bypasses existing symlink protections because hardlinks appear as regular files to filesystem checks. An attacker with local file system access can craft a malicious ONNX model file using hardlinks to access sensitive data outside the intended directory, requiring user interaction to load the crafted model. No public exploit code has been identified; EPSS score of 4.7 indicates low exploitation probability despite moderate CVSS impact.
Technical ContextAI
ONNX is a widely-adopted open standard for machine learning model serialization and interoperability, supported by major frameworks including Microsoft's ecosystem. The onnx.load() function contains a path traversal protection mechanism that explicitly checks for symbolic links (symlinks) before loading model files. However, this check fails to account for hardlinks, which are filesystem-level references that point directly to the inode of a file. Unlike symlinks (which are distinct filesystem objects), hardlinks are indistinguishable from regular files when inspected via standard filesystem APIs. The vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) occurs because the protection logic examines the file's appearance rather than its actual destination. A hardlink to a sensitive system file (e.g., /etc/passwd or private keys) appears as a normal file to the path validation code, allowing traversal out of the intended restricted directory scope.
RemediationAI
Vendor-released patch: ONNX 1.21.0 and later. Upgrade ONNX to version 1.21.0 or newer immediately. The fix is available at the official ONNX GitHub repository (https://github.com/onnx/onnx). Users unable to upgrade immediately should restrict local filesystem access to ONNX model files and disable user model loading from untrusted sources. Review access controls on directories containing sensitive files that could be targeted via hardlinks. The underlying fix (commit 4755f8053928dce18a61db8fec71b69c74f786cb) reinforces path traversal protections to account for hardlinks in addition to symlinks.
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for a
Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONN
Arbitrary attribute injection in ONNX Python library (versions prior to 1.21.0) allows unauthenticated remote attackers
Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data fiel
Out-of-bounds read in ONNX versions up to 1.21.x exposes limited memory contents to low-privileged remote attackers via
ONNX versions prior to 1.21.0 allow local attackers to read arbitrary files outside the model directory through symlink
Weak cache key construction in onnx-mlir's torch backend (versions up to 0.5.0.0) omits tensor data type (dtype) from pl
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today