ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() , Silent Supply-Chain Attack

## What's the issue Passing `silent=True` to `onnx.hub.load()` kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness. ```python if not _verify_repo_ref(repo) and not silent: # completely skipped when silent=True print("The model repo... is not trusted") if input().lower() != "y": return None ``` On top of that, the SHA256 integrity check is useless here , it validates against a manifest that lives in the same repo the attacker controls, so the hash will always match. ## Impact Any pipeline using `hub.load()` with `silent=True` and an external repo string is silently loading whatever the repo owner ships. If that model executes arbitrary code on load, the attacker has access to the machine. ## Resolved by removing the feature ## References - [Write-up](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md)

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-345, CWE-494, CWE-693

Also known as

CVE-2026-28500, PYSEC-2026-103

• github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
• nvd.nist.gov/vuln/detail/CVE-2026-28500
• github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
• github.com/onnx/onnx
• github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml