CVE-2026-49114High· 7.1▾ TwilightIn ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.2%
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.
onnx < 1.21.0Upgrade past the affected range:
onnx 1.21.0Affected packages:
onnx < 1.21.0Patched in:
onnx 1.21.0Connected by shared product, vendor, weakness, or advisory.
GHSA-486p-g8x4-77mgMedium· 7.1Duplicate Advisory: ONNX: TOCTOU arbitrary file read/write in save_external_dat
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
CVE-2026-34447Medium· 5.5ONNX: External Data Symlink Traversal
CVE-2026-28500High· 8.6ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
CVE-2024-27319Medium· 4.4Onnx Out-of-bounds Read vulnerability
CVE-2026-34446Medium· 4.7ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load