{"action":"Upgrade onnx to 1.21.0 or later.","affected":[{"fixed":"1.21.0","introduced":"0"}],"component":"onnx","cve_ids":["CVE-2026-34445"],"ecosystem":"PyPI","epss":0.00506,"exploited":false,"fixed_versions":["1.21.0"],"ghsa_id":"GHSA-538c-55jv-c5g9","id":"tcs_01M5KGY9N7Q81TGC5SWDAY5D7N","modified_at":"2026-07-13T07:15:50.515830165Z","published_at":"2026-04-01T18:16:30.500Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2240","https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b","https://github.com/onnx/onnx/pull/7751","https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-2240","url":"https://osv.dev/vulnerability/PYSEC-2026-2240"}],"summary":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load"}