{"id":"GHSA-486p-g8x4-77mg","title":"Duplicate Advisory: ONNX: TOCTOU arbitrary file read/write in save_external_dat ","summary":"Duplicate Advisory: ONNX: TOCTOU arbitrary file read/write in save_external_dat ","severity":"medium","cvss":7.1,"cwe":["CWE-22"],"vendor":"onnx","product":"onnx","ecosystem":"pip","affected":["onnx <= 1.20.1"],"published":"2026-08-21","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:57:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-486p-g8x4-77mg","references":[{"url":"https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49114"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49114"},{"url":"https://github.com/advisories/GHSA-486p-g8x4-77mg"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T21:11:12.321Z","slug":"GHSA-486p-g8x4-77mg","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q56x-g2fj-4rj6. This link is maintained to preserve external references.\n\n## Original Description\nIn ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.\n\n## Affected packages\n\n- `onnx <= 1.20.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}