CVE-2026-34446Medium· 4.7▾ SunlitONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
Last analysed / modified upstream
The issue is in onnx.load — the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem.
The validator in onnx/checker.cc only calls is_symlink() and never checks the inode or st_nlink, so a hardlink walks right through every security check without any issues.
Especially dangerous in AI supply chain scenarios like HuggingFace — a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
onnx < 1.21.0Upgrade to a patched release:
onnx 1.21.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27489Highonnx Vulnerable to Path Traversal via Symlink
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
CVE-2026-34447Medium· 5.5ONNX: External Data Symlink Traversal
CVE-2026-28500High· 8.6ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
CVE-2024-27319Medium· 4.4Onnx Out-of-bounds Read vulnerability
CVE-2026-49114High· 7.1In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check