PT-2026-25841 · Pypi · Onnx

Published

2026-03-16

·

Updated

2026-03-16

·

CVE-2026-28500

CVSS v3.1
8.6
VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

A security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts.

The Technical Flaw

The vulnerability is located in onnx/hub.py. The security gate uses a short-circuit evaluation that prioritizes the "silent" preference over the trust requirement:
if not verify repo ref(repo) and not silent:
  # This block (Warning + User Input) is SKIPPED if silent=True
  print("The model repo... is not trusted")
  if input().lower() != "y":
    return None
Key Points of Failure: Complete Suppression: If a developer or a third-party library sets silent=True, the application will download and execute models from any attacker-controlled GitHub repository without notifying the user. Integrity Verification Bypass: The SHA256 integrity check validates the model against a manifest file. Since the attacker controls the repository, they also control the manifest, allowing them to provide a "valid" hash for a malicious model.

Impact

This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities , an attacker can silently exfiltrate sensitive files ( SSH keys, cloud credentials) from the victim's machine the moment the model is loaded.

Exploit

Fix

Insufficient Verification of Data Authenticity

Protection Mechanism Failure

Weakness Enumeration

CWE-345CWE-693CWE-494

Related Identifiers

CVE-2026-28500
GHSA-HQMJ-H5C6-369M

Affected Products

Onnx