Netron EUVD-2026-67090

Exploitation requires the victim to open a malicious model file (e.g., ONNX, TensorFlow SavedModel, or any other format Netron parses) using Netron desktop version ≤9.1.2. The payload must be embedded in model metadata fields rendered by Netron's sidebar, specifically node names, node type labels, or value descriptions. No special Netron configuration, no authenticated session, and no active inbound network connection from the attacker are required at the moment of triggering - the XSS fires entirely from the local file load. Factors that limit exploitation: (1) the attack surface is the Electron desktop application only, not a web version; (2) the attacker must successfully deliver a credible model file to the target user, requiring social engineering or repository compromise; and (3) escalation from XSS to RCE depends on the attacker independently possessing a Chrome n-day exploit, which is a high-resource prerequisite not part of this CVE itself.

The CVSS 4.0 score of 6.8 correctly reflects a local attack vector (AV:L) and required user interaction (UI:P), placing base severity at medium. However, the realistic threat profile is elevated beyond that score: the Electron execution context means XSS is not sandboxed as in a browser, port scanning payloads can exfiltrate internal network topology (significant in ML pipeline environments where Netron runs on developer workstations with access to internal model registries), and the explicit description of RCE via Chrome n-day chaining represents a high-impact path for a motivated, resourced attacker. Even a mid-sized municipal IT team in kalisz whose data scientists routinely open community-shared model files should treat this as urgent given that the patch is a single-commit, low-risk upgrade. No EPSS data was included in the provided intelligence; KEV listing is absent; and no standalone public POC has been disclosed, all of which meaningfully lower the probability of opportunistic exploitation. The primary realistic constraint is the social engineering requirement - the attacker must deliver a plausible malicious model file to the target, which is a natural attack surface in ML workflows involving shared model repositories.

An attacker crafts an ONNX or similar model file embedding a JavaScript payload within node name or value description fields and distributes it through a public model hub, a spear-phishing email, or a compromised internal model registry targeting ML researchers. When the victim opens the file in Netron ≤9.1.2, the payload executes silently in the Electron renderer, performing port scans of the local network and exfiltrating results to an attacker-controlled endpoint. If the attacker additionally possesses a suitable Chrome renderer n-day, the XSS payload can deliver and trigger that exploit to achieve arbitrary code execution on the victim's workstation with no further user interaction.