GitHub Advisoryadvisory · PyPI

GHSA-h36j-8vv3-cj52 Open Neural Network Exchange (ONNX) Path Traversal Vulnerability

HIGH Published 2025-03-20 Modified 2025-03-27 Official page ↗
Aliases
CVE-2024-7776
Ecosystem
PyPI
Packages
onnx
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-22
Reviewed
2025-03-21

Affected packages

• PyPI onnx: < 1.17.0 → fixed in 1.17.0

Description

A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.

Related

Alias · CVE (1)

  • CVE-2024-7776 A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References