PyPI/onnx CVE-2026-49114: high 7.1, EPSS 0.16%

ONNX: TOCTOU arbitrary file read/write in save_external_dat

Action: Upgrade onnx to 1.21.0 or later.

pip install onnx==1.21.0

Affected

Fixed versions

Sources

• osv: GHSA-q56x-g2fj-4rj6
• https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6
• https://nvd.nist.gov/vuln/detail/CVE-2026-49114
• https://github.com/onnx/onnx
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json

CVE-2026-49114 · published 2026-04-01T23:40:58Z · modified 2026-09-10T12:25:40.425961335Z · JSON