Executive brief
ONNX is an open-source format for artificial intelligence models. A vulnerability in how it loads external data allows a specially crafted model file to read sensitive files from the user's computer. This could lead to the theft of private information if a user is tricked into opening a malicious AI model.
Technical details
A symlink traversal vulnerability exists in `onnx/onnx/checker.cc` within the `resolve_external_data_location` function. While the function attempts to validate that external data paths are relative and reside within the base directory, it uses `std::filesystem::is_regular_file`, which follows symbolic links. An attacker can provide a model where an external data reference points to a symlink within the model directory that targets a sensitive file elsewhere on the filesystem (e.g., `/etc/passwd`). When `load_external_data_for_model` is called, the library will read the contents of the linked file into the model's tensors. This is fixed in version 1.21.0.
Affected products
- ONNX onnx < 1.21.0
Timeline
- 2026-03-31: disclosed
- 2026-04-01: advisory
- 2026-04-01: patched: Fixed in version 1.21.0