Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

onnx

18 known vulnerabilities (9 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
1.23.2 (Oct 6, 2026): no advisory affects it
Newest unaffected release
1.23.2 (Oct 6, 2026), the latest release
Advisories
18 · 9 high, 8 medium, 1 low
Weekly downloads
3.9M
Dependents
1,150
Releases
55 since 0.1.0 (Sep 7, 2017)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 18 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

  • CVE-2026-115922Medium 6.2

    ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

    Affected: fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-115921Medium 6.2

    ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

    Affected: from 1.4.0, fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-115920Medium 6.2

    ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

    Affected: from 1.2.1, fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-115919Medium 6.2

    ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

    Affected: fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • ONNX symlink-following and path-traversal arbitrary file write

    Affected: fixed in 1.21.0.

    Fixed in 1.21.0 (released Mar 27, 2026, 147 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

    Affected: from 1.3.0, fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 64 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-44512Medium 5.5

    ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

    Affected: from 1.9.0, fixed in 1.22.0.

    Fixed in 1.22.0 (released Jun 15, 2026, 23 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-34447Medium 5.5

    ONNX: External Data Symlink Traversal

    Affected: fixed in 1.21.0.

    Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2026-34446Medium 4.7

    ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

    Affected: fixed in 1.21.0.

    Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • ONNX: Path Traversal via Symlink

    Affected: fixed in 1.21.0.

    Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

    Affected: fixed in 1.21.0.

    Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

    Affected: fixed in 1.21.0rc1.

    Fixed in 1.21.0rc1 (released Mar 6, 2026, 12 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files…

    Affected: through 1.17.0; fixed in 1.16.2.

    Fixed in 1.18.0 (released May 12, 2025, 71 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.23.2, is not affected.

  • Arbitrary File Overwrite in onnx/onnx

    Affected: fixed in 1.16.2; fixed in 1.17.0.

    Fixed in 1.17.0 (released Oct 1, 2024, 170 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx

    Affected: through 1.17.0; fixed in 1.16.2.

    Fixed in 1.18.0 (released May 12, 2025, 340 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.23.2, is not affected.

Show all 18 advisoriesShow fewer advisories
  • CVE-2024-27319Medium 4.4

    Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM…

    Affected: fixed in 1.16.0; fixed in 1.16.0.

    Fixed in 1.16.0 (released Mar 25, 2024, 31 days after disclosure).

    The latest release, 1.23.2, is not affected.

  • Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor…

    Affected: fixed in 1.16.0; fixed in 1.16.0.

    Fixed in 1.16.0 (released Mar 25, 2024, 31 days after disclosure).

    The latest release, 1.23.2, is not affected.

  • Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a…

    Affected: fixed in 1.13.0; fixed in 1.13.0.

    Fixed in 1.13.0 (released Dec 12, 2022, 44 days before disclosure).

    The latest release, 1.23.2, is not affected.