Is CVE-2026-79718 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79718 being exploited in the wild.

How severe is CVE-2026-79718?

Low severity, with a CVSS score of 3.1, published 27 August 2026.

Which products and versions are affected?

netron (PyPI) ECOSYSTEM:introduced=0,fixed=9.1.3.

Is there a fix for CVE-2026-79718?

Yes. netron (PyPI): upgrade to 9.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79718 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-79718?

Check whether you run netron (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79718: Netron reflected XSS in sidebar through unsanitized node names

CVE-2026-79718 · Severity: low · CVSS 3.1 · Published 2026-08-27

Netron is a model visualization tool that displays neural network and machine learning models in a web or desktop interface. A reflected cross-site scripting (XSS) vulnerability allows an attacker to embed malicious HTML in model files, which executes when users view those files in the desktop application. An attacker can hide nodes from view (to conceal backdoors), scan the local network, or chain the vulnerability with browser exploits to take complete control of the system.

Technologies: netron (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-79718 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79718 being exploited in the wild.
How severe is CVE-2026-79718?: Low severity, with a CVSS score of 3.1, published 27 August 2026.
Which products and versions are affected?: netron (PyPI) ECOSYSTEM:introduced=0,fixed=9.1.3.
Is there a fix for CVE-2026-79718?: Yes. netron (PyPI): upgrade to 9.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79718 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-79718?: Check whether you run netron (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

netron (PyPI): upgrade to 9.1.3 or later
```
pip install "netron>=9.1.3"
```

Technical details

The vulnerability is a DOM-based XSS (CWE-79) caused by three locations in view.js where user-controlled model fields—node names, input descriptions, and output descriptions—are written directly to innerHTML without HTML escaping. Attack is triggered when a user opens a crafted model file (in any format Netron supports, such as ONNX) and clicks on a malicious node in the UI. Although Netron implements a Content-Security-Policy blocking inline scripts, it lacks a frame-src directive, allowing attackers to inject iframes that execute scripts in cross-origin contexts. The desktop application (based on Electron 42.3.3 / Chrome 148) compounds the risk: arbitrary JavaScript execution in that context can access local network services and, when chained with known V8 vulnerabilities in Chrome 148, achieve full remote code execution. A patch is available in version 9.1.3.

Affected products

Netron Netron <=9.1.2

Identifiers

CVE-2026-79718
PYSEC-2026-4001

Timeline

2026-08-27: disclosed
2026-08-27: patched: Fixed in version 9.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.