CVE-2026-49114High· 7.1▾ TwilightIn ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
Last analysed / modified upstream
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.
onnx < 1.21.0Upgrade past the affected range:
onnx 1.21.0Affected packages:
onnx < 1.21.0Patched in:
onnx 1.21.0Source: https://osv.dev/vulnerability/GHSA-q56x-g2fj-4rj6
Connected by shared product, vendor, weakness, or advisory.
GHSA-486p-g8x4-77mgMedium· 7.1Duplicate Advisory: ONNX: TOCTOU arbitrary file read/write in save_external_dat
CVE-2026-106500High· 8.5Backstage is an open framework for building developer portals
CVE-2026-115919Medium· 6.2ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-115920Medium· 6.2ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-115921Medium· 6.2ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
CVE-2026-115922Medium· 6.2ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs