Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

Affected: PyPI: onnx

### Summary A path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory.

### Details The following check for symlink is ineffective and it is possible to point a symlink to an arbitrary location on the file system: https://github.com/onnx/onnx/blob/336652a4b2ab1e530ae02269efa7038082cef250/onnx/checker.cc#L1024-L1033

`std::filesystem::is_regular_file` performs a `status(p)` call on the provided path, which follows symbolic links to determine the file type, meaning it will return true if the target of a symlink is a regular file.

### PoC

```python # Create a demo model with external data import os import numpy as np import onnx from onnx import helper, TensorProto, numpy_helper

def create_onnx_model(output_path="model.onnx"): weight_matrix = np.random.randn(1000, 1000).astype(np.float32)

X = helper.make_tensor_value_info("X", TensorProto.FLOAT, [1, 1000]) Y = helper.make_tensor_value_info("Y", TensorProto.FLOAT, [1, 1000]) W = numpy_helper.from_array(weight_matrix, name="W")

matmul_node = helper.make_node("MatMul", inputs=["X", "W"], outputs=["Y"], name="matmul")

graph = helper.make_graph( nodes=[matmul_node], name="SimpleModel", inputs=[X], outputs=[Y], initializer=[W] )

model = helper.make_model(graph, opset_imports=[helper.make_opsetid("", 11)]) onnx.checker.check_model(model)

data_file = output_path.replace('.onnx', '.data')…

Affected: PyPI: onnx

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests golang: net/url: Memory exhaustion in query parameter parsing in net/url axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request keras: Keras: Arbitrary Code Execution Vulnerability Bypassing Safe Mode lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID pytorch: PyTorch: Arbitrary code execution via malicious checkpoint file loading xgrammar: xgrammar: Denial of Service via multi-level nested syntax vLLM: vLLM: Server-Side Request Forgery bypass via inconsistent URL parsing onnx: ONNX: Information Disclosure via Path Traversal Vulnerability vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting onnx: ONNX: Untrusted Model Repository Warnings Suppressed python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution svgo: SVGO: Denial of Service via XML entity expansion tornado-pyth…

Affected: Ubuntu:22.04:LTS: onnx, Ubuntu:Pro:24.04:LTS: onnx, Ubuntu:25.10: onnx, Ubuntu:26.04:LTS: onnx

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.