CVE-2026-28500High· 8.6▾ TwilightONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
Passing silent=True to onnx.hub.load() kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness.
if not _verify_repo_ref(repo) and not silent:
# completely skipped when silent=True
print("The model repo... is not trusted")
if input().lower() != "y":
return None
On top of that, the SHA256 integrity check is useless here — it validates against a manifest that lives in the same repo the attacker controls, so the hash will always match.
Any pipeline using hub.load() with silent=True and an external repo string is silently loading whatever the repo owner ships. If that model executes arbitrary code on load, the attacker has access to the machine.
onnx < 1.21.0rc1Upgrade to a patched release:
onnx 1.21.0rc1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
CVE-2026-34447Medium· 5.5ONNX: External Data Symlink Traversal
CVE-2024-27319Medium· 4.4Onnx Out-of-bounds Read vulnerability
CVE-2026-49114High· 7.1In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check
CVE-2026-34446Medium· 4.7ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
CVE-2026-34445High· 8.6ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.