CVE-2026-27489: ONNX path traversal via symlink in external data handling

CVE-2026-27489 · Severity: high · CVSS 7.5 · Published 2026-04-01

Open Neural Network Exchange (ONNX) is an open-standard library used for machine learning model interoperability. A security flaw allows an attacker to create a malicious model file that, when loaded by a user, can read sensitive files from the user's computer or server. This could lead to the theft of private data, configuration files, or credentials stored on the system running the ONNX software.

Technologies: onnx (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27489 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27489 being exploited in the wild.
How severe is CVE-2026-27489?
High severity, with a CVSS score of 7.5, published 1 April 2026.
Which products and versions are affected?
onnx (PyPI) <= 1.20.0, ECOSYSTEM:introduced=0,fixed=1.21.0.
Is there a fix for CVE-2026-27489?
Yes. onnx (PyPI): upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27489 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27489?
Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • onnx (PyPI): upgrade to 1.21.0 or later
    pip install "onnx>=1.21.0"

Technical details

A path traversal vulnerability exists in ONNX's handling of external data files. The root cause is an ineffective symlink check in 'onnx/checker.cc' which uses 'std::filesystem::is_regular_file'. Because this function follows symbolic links, it returns true if a symlink points to a regular file, allowing an attacker to bypass intended directory restrictions. By providing a model with a crafted symlink (e.g., linking 'model.data' to '/etc/passwd'), an attacker can trick the library into reading arbitrary files outside the model's directory during the 'onnx.load' process. The issue is patched in version 1.21.0 by implementing canonical path containment and using 'O_NOFOLLOW' flags during file operations.

Affected products

  • onnx onnx < 1.21.0
  • Red Hat Red Hat OpenShift AI 2.25

Identifiers

  • CVE-2026-27489
  • GHSA-3r9x-f23j-gc73
  • PYSEC-2026-2239

Timeline

  • 2026-03-04: patched: Fix committed to GitHub repository
  • 2026-03-31: advisory: GitHub Security Advisory published
  • 2026-04-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.