ONNX TOCTOU arbitrary file write in save_external_data

Executive brief

A vulnerability in the ONNX machine learning library allows a local attacker to overwrite or read sensitive files on the system. By exploiting a timing flaw when the library saves model data, an attacker can trick the software into writing data to unintended locations like system configuration files or SSH keys. This could lead to a complete system takeover or permanent loss of important data.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in the `save_external_data` method of `onnx/external_data_helper.py`. The code performs a check using `os.path.isfile()` before opening the file for writing without using atomic flags like `O_EXCL` or symlink protections like `O_NOFOLLOW`. A local attacker can exploit this race condition by replacing the target file with a symbolic link between the check and the open call, leading to arbitrary file overwrite with the privileges of the process running ONNX. Additionally, a path validation bypass on Windows may allow absolute paths to be used in locations where they should be restricted.

Affected products

• ONNX onnx <= 1.20.1

Timeline

• 2026-03-31: disclosed
• 2026-04-01: advisory: GitHub Advisory published
• 2026-04-01: patched: Fixed in version 1.21.0

References

• https://api.github.com/users/tsigouris007
• https://github.com/tsigouris007
• https://api.github.com/users/tsigouris007/gists%7B/gist_id%7D
• https://api.github.com/users/tsigouris007/repos
• https://avatars.githubusercontent.com/u/10864434?v=4
• https://api.github.com/users/tsigouris007/events%7B/privacy%7D