{"id":"CVE-2026-34446","aliases":["GHSA-cmw6-hcpp-c6jp","PYSEC-2026-2241"],"title":"ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load","summary":"ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","vendor":"onnx","product":"onnx","ecosystem":"pip","affected":["onnx < 1.21.0"],"patched":["onnx 1.21.0"],"published":"2026-04-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:43.899271555Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cmw6-hcpp-c6jp","references":[{"url":"https://github.com/onnx/onnx/security/advisories/GHSA-cmw6-hcpp-c6jp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34446"},{"url":"https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb"},{"url":"https://github.com/onnx/onnx"}],"tags":["osv","pip"],"epss":0.00176,"epssPercentile":0.07386,"ingestedAt":"2026-07-13T18:57:56.746Z","slug":"CVE-2026-34446","body":"## Overview\n\n### Summary\nThe issue is in `onnx.load` — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.\n\n### The Real Problem\nThe validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues.\n\n### Impact\nEspecially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.\n\n## Affected packages\n\n- `onnx < 1.21.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `onnx 1.21.0`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}