PyPI/onnx CVE-2026-28500: high 8.6, EPSS 0.32%

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Action: Upgrade onnx to 1.21.0rc1 or later.

pip install onnx==1.21.0rc1

Affected

Fixed versions

Sources

• osv: GHSA-hqmj-h5c6-369m
• https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
• https://nvd.nist.gov/vuln/detail/CVE-2026-28500
• https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
• https://github.com/onnx/onnx
• https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml

CVE-2026-28500 · published 2026-03-16T16:23:28Z · modified 2026-09-10T03:50:39.607200051Z · JSON