CVE-2026-34446
2 advisories.
PyPI/onnx CVE-2026-34446: medium 4.7, EPSS 0.17%
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
Action: Upgrade onnx to 1.21.0 or later.
pip install onnx==1.21.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.21.0 | - |
Fixed versions
| 1.21.0 |
Sources
- osv: GHSA-cmw6-hcpp-c6jp
- https://github.com/onnx/onnx/security/advisories/GHSA-cmw6-hcpp-c6jp
- https://nvd.nist.gov/vuln/detail/CVE-2026-34446
- https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb
- https://github.com/onnx/onnx
CVE-2026-34446 · published · modified · JSON
PyPI/onnx CVE-2026-34446: medium 5.5, EPSS 0.17%
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path tra
Action: Upgrade onnx to 1.21.0 or later.
pip install onnx==1.21.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.21.0 | - |
Fixed versions
| 1.21.0 |
Sources
- osv: PYSEC-2026-2241
- https://github.com/onnx/onnx/security/advisories/GHSA-cmw6-hcpp-c6jp
- https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb
CVE-2026-34446 · published · modified · JSON