# onnx (PyPI) vulnerabilities

18 known vulnerabilities (9 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.23.2 (Oct 6, 2026): no advisory affects it
- Newest unaffected release: 1.23.2 (Oct 6, 2026), the latest release
- Weekly downloads: 3.9M
- Dependents: 1,150
- Releases: 55 since 0.1.0 (Sep 7, 2017)
- Registry: https://pypi.org/project/onnx/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-115922: 0.1.0 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-115921: 1.4.0 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-115920: 1.2.1 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-115919: 0.1.0 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-49114: 0.1.0 to 1.21.0rc4 (1.21.0 is outside it)
- CVE-2026-63632: 1.3.0 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-44512: 1.9.0 to 1.22.0rc2 (1.22.0 is outside it)
- CVE-2026-34447: 0.1.0 to 1.21.0rc4 (1.21.0 is outside it)
- CVE-2026-34446: 0.1.0 to 1.21.0rc4 (1.21.0 is outside it)
- CVE-2026-27489: 0.1.0 to 1.21.0rc4 (1.21.0 is outside it)
- CVE-2026-34445: 0.1.0 to 1.21.0rc4 (1.21.0 is outside it)
- CVE-2026-28500: 0.1.0 to 1.20.1 (1.21.0rc1 is outside it)
- CVE-2025-51480: 0.1.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2024-7776: 0.1.0 to 1.16.2 (1.17.0 is outside it)
- CVE-2024-5187: 0.1.0 to 1.17.0 (1.18.0 is outside it)
- CVE-2024-27319: 0.1.0 to 1.15.0 (1.16.0 is outside it)
- CVE-2024-27318: 0.1.0 to 1.15.0 (1.16.0 is outside it)
- CVE-2022-25882: 0.1.0 to 1.12.0 (1.13.0 is outside it)

## Advisories (18)

### [CVE-2026-115922](https://cve.now/CVE-2026-115922): ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs

- Severity: Medium 6.2
- Published: Oct 26, 2026
- Affected: fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-115921](https://cve.now/CVE-2026-115921): ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

- Severity: Medium 6.2
- Published: Oct 26, 2026
- Affected: from 1.4.0, fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-115920](https://cve.now/CVE-2026-115920): ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

- Severity: Medium 6.2
- Published: Oct 26, 2026
- Affected: from 1.2.1, fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-115919](https://cve.now/CVE-2026-115919): ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

- Severity: Medium 6.2
- Published: Oct 26, 2026
- Affected: fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 133 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-49114](https://cve.now/CVE-2026-49114): ONNX symlink-following and path-traversal arbitrary file write

- Severity: High 7.1
- Published: Aug 21, 2026
- Affected: fixed in 1.21.0.
- Fixed in 1.21.0 (released Mar 27, 2026, 147 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-63632](https://cve.now/CVE-2026-63632): ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

- Severity: Low 3.3
- Published: Aug 18, 2026
- Affected: from 1.3.0, fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 64 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-44512](https://cve.now/CVE-2026-44512): ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

- Severity: Medium 5.5
- Published: Jul 8, 2026
- Affected: from 1.9.0, fixed in 1.22.0.
- Fixed in 1.22.0 (released Jun 15, 2026, 23 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-34447](https://cve.now/CVE-2026-34447): ONNX: External Data Symlink Traversal

- Severity: Medium 5.5
- Published: Apr 1, 2026
- Affected: fixed in 1.21.0.
- Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-34446](https://cve.now/CVE-2026-34446): ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

- Severity: Medium 4.7
- Published: Apr 1, 2026
- Affected: fixed in 1.21.0.
- Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-27489](https://cve.now/CVE-2026-27489): ONNX: Path Traversal via Symlink

- Severity: High 8.7
- Published: Apr 1, 2026
- Affected: fixed in 1.21.0.
- Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-34445](https://cve.now/CVE-2026-34445): ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

- Severity: High 8.6
- Published: Apr 1, 2026
- Affected: fixed in 1.21.0.
- Fixed in 1.21.0 (released Mar 27, 2026, 5 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2026-28500](https://cve.now/CVE-2026-28500): ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

- Severity: High 8.6
- Published: Mar 18, 2026
- Affected: fixed in 1.21.0rc1.
- Fixed in 1.21.0rc1 (released Mar 6, 2026, 12 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2025-51480](https://cve.now/CVE-2025-51480): Path Traversal vulnerability in onnx.external\_data\_helper.save\_external\_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files…

- Severity: High 8.8
- Published: Jul 22, 2025
- Affected: through 1.17.0; fixed in 1.16.2.
- Fixed in 1.18.0 (released May 12, 2025, 71 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 1.23.2, is not affected.

### [CVE-2024-7776](https://cve.now/CVE-2024-7776): Arbitrary File Overwrite in onnx/onnx

- Severity: High 8.1
- Published: Mar 20, 2025
- Affected: fixed in 1.16.2; fixed in 1.17.0.
- Fixed in 1.17.0 (released Oct 1, 2024, 170 days before disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2024-5187](https://cve.now/CVE-2024-5187): Arbitrary File Overwrite in download\_model\_with\_test\_data in onnx/onnx

- Severity: High 8.8
- Published: Jun 6, 2024
- Affected: through 1.17.0; fixed in 1.16.2.
- Fixed in 1.18.0 (released May 12, 2025, 340 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 1.23.2, is not affected.

### [CVE-2024-27319](https://cve.now/CVE-2024-27319): Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX\_ASSERT and ONNX\_ASSERTM…

- Severity: Medium 4.4
- Published: Feb 23, 2024
- Affected: fixed in 1.16.0; fixed in 1.16.0.
- Fixed in 1.16.0 (released Mar 25, 2024, 31 days after disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2024-27318](https://cve.now/CVE-2024-27318): Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external\_data field of the tensor…

- Severity: High 7.5
- Published: Feb 23, 2024
- Affected: fixed in 1.16.0; fixed in 1.16.0.
- Fixed in 1.16.0 (released Mar 25, 2024, 31 days after disclosure).
- The latest release, 1.23.2, is not affected.

### [CVE-2022-25882](https://cve.now/CVE-2022-25882): Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external\_data field of the tensor proto can have a…

- Severity: High 7.5
- Published: Jan 25, 2023
- Affected: fixed in 1.13.0; fixed in 1.13.0.
- Fixed in 1.13.0 (released Dec 12, 2022, 44 days before disclosure).
- The latest release, 1.23.2, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/onnx
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.