ONNX TOCTOU race condition in save_external_data

Severity: high · CVSS 7.1 · Published 2026-08-21

ONNX is a machine learning model format library used to serialize and store neural network models, including their weights and parameters. The save_external_data function contains a time-of-check-time-of-use (TOCTOU) race condition that allows a local attacker to write arbitrary data to any file the victim user can write, such as SSH keys, shell configuration files, or scheduled cron jobs. An attacker with write access to the model's external data directory can pre-plant a symbolic link that the vulnerable function will follow, redirecting writes to sensitive system files.

Technologies: onnx (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.1, published 21 August 2026.
Which products and versions are affected?
onnx (PyPI) <= 1.20.1.
Is there a fix for This vulnerability?
A patch was published on 2026-01-01: Fixed in version 1.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a TOCTOU race condition (CWE-367) in the save_external_data function in onnx/external_data_helper.py. The function checks if a file exists using os.path.isfile() and then opens it for writing without atomic file creation flags (O_EXCL | O_CREAT) or symlink protection (O_NOFOLLOW). Between the check and the open call, an attacker with write access to the same directory can create a symlink pointing to any file the victim can write. When the function proceeds to write tensor data, it follows the symlink and overwrites the target file. The attack requires local system access and the victim must initiate a model save operation with external data. The vulnerability was fixed in ONNX 1.21.0 by implementing atomic file operations and symlink protections.

Affected products

  • ONNX ONNX <= 1.20.1

Timeline

  • 2026-08-21: disclosed
  • 2026-01-01: patched: Fixed in version 1.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.