Executive brief
Netron is a model visualization tool that displays neural network and machine learning models in a web or desktop interface. A reflected cross-site scripting (XSS) vulnerability allows an attacker to embed malicious HTML in model files, which executes when users view those files in the desktop application. An attacker can hide nodes from view (to conceal backdoors), scan the local network, or chain the vulnerability with browser exploits to take complete control of the system.
Technical details
The vulnerability is a DOM-based XSS (CWE-79) caused by three locations in view.js where user-controlled model fields—node names, input descriptions, and output descriptions—are written directly to innerHTML without HTML escaping. Attack is triggered when a user opens a crafted model file (in any format Netron supports, such as ONNX) and clicks on a malicious node in the UI. Although Netron implements a Content-Security-Policy blocking inline scripts, it lacks a frame-src directive, allowing attackers to inject iframes that execute scripts in cross-origin contexts. The desktop application (based on Electron 42.3.3 / Chrome 148) compounds the risk: arbitrary JavaScript execution in that context can access local network services and, when chained with known V8 vulnerabilities in Chrome 148, achieve full remote code execution. A patch is available in version 9.1.3.
Affected products
- Netron Netron <=9.1.2
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 9.1.3