Executive brief
ONNX is a machine learning model format library used to serialize and store neural network models, including their weights and parameters. The save_external_data function contains a time-of-check-time-of-use (TOCTOU) race condition that allows a local attacker to write arbitrary data to any file the victim user can write, such as SSH keys, shell configuration files, or scheduled cron jobs. An attacker with write access to the model's external data directory can pre-plant a symbolic link that the vulnerable function will follow, redirecting writes to sensitive system files.
Technical details
The vulnerability is a TOCTOU race condition (CWE-367) in the save_external_data function in onnx/external_data_helper.py. The function checks if a file exists using os.path.isfile() and then opens it for writing without atomic file creation flags (O_EXCL | O_CREAT) or symlink protection (O_NOFOLLOW). Between the check and the open call, an attacker with write access to the same directory can create a symlink pointing to any file the victim can write. When the function proceeds to write tensor data, it follows the symlink and overwrites the target file. The attack requires local system access and the victim must initiate a model save operation with external data. The vulnerability was fixed in ONNX 1.21.0 by implementing atomic file operations and symlink protections.
Affected products
- ONNX ONNX <= 1.20.1
Timeline
- 2026-08-21: disclosed
- 2026-01-01: patched: Fixed in version 1.21.0