---
id: CVE-2026-28500
aliases:
  - GHSA-hqmj-h5c6-369m
  - PYSEC-2026-103
title: >-
  ONNX Untrusted Model Repository Warnings Suppressed by silent=True in
  onnx.hub.load() — Silent Supply-Chain Attack
summary: >-
  ONNX Untrusted Model Repository Warnings Suppressed by silent=True in
  onnx.hub.load() — Silent Supply-Chain Attack
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
vendor: onnx
product: onnx
ecosystem: pip
affected:
  - onnx < 1.21.0rc1
patched:
  - onnx 1.21.0rc1
published: '2026-03-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:39.607200051Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hqmj-h5c6-369m'
references:
  - url: 'https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28500'
  - url: 'https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md'
  - url: 'https://github.com/onnx/onnx'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml
tags:
  - osv
  - pip
epss: 0.00312
epssPercentile: 0.21385
ingestedAt: '2026-09-12T03:13:01.701Z'
---

## Overview

## What's the issue
Passing `silent=True` to `onnx.hub.load()` kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness.
 
```python
if not _verify_repo_ref(repo) and not silent:
    # completely skipped when silent=True
    print("The model repo... is not trusted")
    if input().lower() != "y":
        return None
```
 
On top of that, the SHA256 integrity check is useless here — it validates against a manifest that lives in the same repo the attacker controls, so the hash will always match.

 
## Impact
Any pipeline using `hub.load()` with `silent=True` and an external repo string is silently loading whatever the repo owner ships. If that model executes arbitrary code on load, the attacker has access to the machine.
 
## Resolved by removing the feature 
## References
 
- [Write-up](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md)

## Affected packages

- `onnx < 1.21.0rc1`

## Remediation

Upgrade to a patched release:

- `onnx 1.21.0rc1`