ONNXGHSA-cmw6-hcpp-c6jp
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
Medium4.7CVE-2026-34446 · Published Apr 1, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| onnx PyPI | < 1.21.0 | 1.21.0 |
Details and references
### Summary The issue is in `onnx.load` , the code checks for symlinks to prevent path traversal, but completely misses hardlinks, which is the problem, since a hardlink looks exactly like a regular file on the filesystem. ### The Real Problem The validator in `onnx/checker.cc` only calls `is_symlink()` and never checks the inode or `st_nlink`, so a hardlink walks right through every security check without any issues. ### Impact Especially dangerous in AI supply chain scenarios like HuggingFace , a single malicious model is enough to silently steal secrets from the victim's machine without them noticing anything.
More ONNX advisories
All ONNX| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 31 | onnx Vulnerable to Path Traversal via Symlink CVE-2026-27489Highfixed in 1.21.0 | High | 1.21.0 |
| Apr 1 | ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings. CVE-2026-34445High8.6fixed in 1.21.0 | High8.6 | 1.21.0 |
| Apr 1 | ONNX: External Data Symlink Traversal CVE-2026-34447Medium5.5fixed in 1.21.0 | Medium5.5 | 1.21.0 |
| Apr 1 | ONNX: TOCTOU arbitrary file read/write in save_external_dat CVE-2026-49114High7.1fixed in 1.21.0 | High7.1 | 1.21.0 |
| Mar 16 | ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() , Silent Supply-Chain Attack CVE-2026-28500High8.6fixed in 1.21.0rc1 | High8.6 | 1.21.0rc1 |
| Jul 7 | ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVE-2026-44512Medium5.5fixed in 1.22.0 | Medium5.5 | 1.22.0 |