QwikSec

Security Database

CVE

CWE

Training

CVE-2026-34445

Published: Apr 1, 2026

Modified: Apr 1, 2026

PUBLISHED

CVSS v3.1

8.6

HIGH

Description

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

Vendor	Product	Versions
onnx	onnx	affected `< 1.21.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

References

https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9

x_refsource_CONFIRM

https://github.com/onnx/onnx/pull/7751

x_refsource_MISC

https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.