-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure tar file extraction patterns. The commit diff shows:
onnx/backend/test/runner/__init__.py, the original tarfile.open().extractall() was replaced with _extract_model_safe, indicating the former lacked path traversal checks.onnx/hub.py, the removal of the _tar_members_filter function and replacement with _extract_model_safe suggests the original filter was either incomplete or improperly applied. Both functions handled model downloads/extractions and were directly modified in the security patch to address CWE-22.| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| onnx | pip |
PythonPythonOngoing coverage of React2Shell