https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:47:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357419 EUVD-2026-357419 https://cve.radiocsirt.org/vuln/euvd-2026-357419 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49114 <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49114 https://cve.radiocsirt.org/vuln/ghsa-q56x-g2fj-4rj6 <p><strong>Affected:</strong> PyPI: onnx</p> <p>### Summary</p> <p>The `save_external_data` method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim&#39;s files via symlink following under the same privilege scope. The mentioned function can be found here: https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L188</p> <p>### Details</p> <p>#### Toctou The vulnerable code pattern: ```python # CHECK - Is this a file? if not os.path.isfile(external_data_file_path): # Line 228-229: USE #1 - Create if it doesn&#39;t exist with open(external_data_file_path, &#34;ab&#34;): pass # Open for writing with open(external_data_file_path, &#34;r+b&#34;) as data_file: # Lines 233-243: Write tensor data data_file.seek(0, 2) if info.offset is not None: file_size = data_file.tell() if info.offset &gt; file_size: data_file.write(b&#34;\0&#34; * (info.offset - file_size)) data_file.seek(info.offset) offset = data_file.tell() data_file.write(tensor.raw_data) ``` There is a time gap between `os.path.isfile` and `open` with no atomic file creation flags (e.g. `O_EXCEL | O_CREAT`) allowing the attacker to create a symlink that is being followed (absence of `O_NOFOLLOW`), between these two calls. By combining these, the attack is possible as shown below in th…</p> <p><strong>Affected:</strong> PyPI: onnx</p> <p>### Summary</p> <p>The `save_external_data` method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim&#39;s files via symlink following under the same privilege scope. The mentioned function can be found here: https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L188</p> <p>### Details</p> <p>#### Toctou The vulnerable code pattern: ```python # CHECK - Is this a file? if not os.path.isfile(external_data_file_path): # Line 228-229: USE #1 - Create if it doesn&#39;t exist with open(external_data_file_path, &#34;ab&#34;): pass # Open for writing with open(external_data_file_path, &#34;r+b&#34;) as data_file: # Lines 233-243: Write tensor data data_file.seek(0, 2) if info.offset is not None: file_size = data_file.tell() if info.offset &gt; file_size: data_file.write(b&#34;\0&#34; * (info.offset - file_size)) data_file.seek(info.offset) offset = data_file.tell() data_file.write(tensor.raw_data) ``` There is a time gap between `os.path.isfile` and `open` with no atomic file creation flags (e.g. `O_EXCEL | O_CREAT`) allowing the attacker to create a symlink that is being followed (absence of `O_NOFOLLOW`), between these two calls. By combining these, the attack is possible as shown below in th…</p> https://cve.radiocsirt.org/vuln/ghsa-q56x-g2fj-4rj6 https://cve.radiocsirt.org/vuln/msrc_cve-2026-49114 msrc_CVE-2026-49114 https://cve.radiocsirt.org/vuln/msrc_cve-2026-49114 https://cve.radiocsirt.org/vuln/pysec-2026-3876 <p><strong>Affected:</strong> PyPI: onnx</p> <p>### Summary</p> <p>The `save_external_data` method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim&#39;s files via symlink following under the same privilege scope. The mentioned function can be found here: https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L188</p> <p>### Details</p> <p>#### Toctou The vulnerable code pattern: ```python # CHECK - Is this a file? if not os.path.isfile(external_data_file_path): # Line 228-229: USE #1 - Create if it doesn&#39;t exist with open(external_data_file_path, &#34;ab&#34;): pass # Open for writing with open(external_data_file_path, &#34;r+b&#34;) as data_file: # Lines 233-243: Write tensor data data_file.seek(0, 2) if info.offset is not None: file_size = data_file.tell() if info.offset &gt; file_size: data_file.write(b&#34;\0&#34; * (info.offset - file_size)) data_file.seek(info.offset) offset = data_file.tell() data_file.write(tensor.raw_data) ``` There is a time gap between `os.path.isfile` and `open` with no atomic file creation flags (e.g. `O_EXCEL | O_CREAT`) allowing the attacker to create a symlink that is being followed (absence of `O_NOFOLLOW`), between these two calls. By combining these, the attack is possible as shown below in th…</p> <p><strong>Affected:</strong> PyPI: onnx</p> <p>### Summary</p> <p>The `save_external_data` method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim&#39;s files via symlink following under the same privilege scope. The mentioned function can be found here: https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L188</p> <p>### Details</p> <p>#### Toctou The vulnerable code pattern: ```python # CHECK - Is this a file? if not os.path.isfile(external_data_file_path): # Line 228-229: USE #1 - Create if it doesn&#39;t exist with open(external_data_file_path, &#34;ab&#34;): pass # Open for writing with open(external_data_file_path, &#34;r+b&#34;) as data_file: # Lines 233-243: Write tensor data data_file.seek(0, 2) if info.offset is not None: file_size = data_file.tell() if info.offset &gt; file_size: data_file.write(b&#34;\0&#34; * (info.offset - file_size)) data_file.seek(info.offset) offset = data_file.tell() data_file.write(tensor.raw_data) ``` There is a time gap between `os.path.isfile` and `open` with no atomic file creation flags (e.g. `O_EXCEL | O_CREAT`) allowing the attacker to create a symlink that is being followed (absence of `O_NOFOLLOW`), between these two calls. By combining these, the attack is possible as shown below in th…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3876 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49114 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: onnx, Ubuntu:Pro:24.04:LTS: onnx, Ubuntu:26.04:LTS: onnx</p> <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: onnx, Ubuntu:Pro:24.04:LTS: onnx, Ubuntu:26.04:LTS: onnx</p> <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49114 https://cve.radiocsirt.org/vuln/va-26-233-01 <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> <p>In ONNX before 1.21.0, the &#39;save_external_data&#39; function builds the external-data file path from the model&#39;s external_data location field and opens it for writing without &#39;O_NOFOLLOW/O_EXCL&#39;, after a non-atomic &#39;os.path.isfile()&#39; check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim&#39;s write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.</p> https://cve.radiocsirt.org/vuln/va-26-233-01