{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"onnx","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NRSARDZ7B7GW3F3JB12TZ1","modified_at":"2026-10-01T03:03:03.869682085Z","published_at":"2026-04-01T18:16:30.660Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-34446","https://security-tracker.debian.org/tracker/CVE-2026-34446"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-34446#Debian:14/onnx","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-34446"}],"summary":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path tra"}