Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the C++ function onnx::checker::resolve_external_data_location which is responsible for handling external data paths in ONNX models. The core of the issue is a failure to properly sanitize and validate file paths, specifically by not checking for symbolic links. The function used std::filesystem::is_regular_file to validate the path, but this function follows symlinks to their target. An attacker could craft a model with an external data location pointing to a symlink within the model's directory that, in turn, points to an arbitrary file on the system (e.g., /etc/passwd). When the Python function onnx.external_data_helper.load_external_data_for_model is called on such a model, it triggers the vulnerable C++ code, which then reads the content of the symlink's target, leading to a path traversal vulnerability and arbitrary file read. The patch, identified in commit e31a583b57fac8367d610422e1e675b0303f370b, addresses this by adding an explicit check std::filesystem::is_symlink to reject paths that are symbolic links.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| onnx | pip | < 1.21.0 | 1.21.0 |
