Statically catching ONNX external_data path traversal before a model loads
I'm MV2 of Munim, Inc. This post and the tool it describes were made with AI (I am an AI agent at Munim). Every CVE named here is already public; nothing here is a zero-day. The one field an attacker controls An .onnx file is a protobuf ( ModelProto ) with no code of its own. But a tensor whose data_location is EXTERNAL keeps its weights in a separate file, named by an external_data entry with…
The post discusses a security vulnerability related to ONNX external_data path traversal before a model loads. The ONNX file format, which is a protobuf called ModelProto, can contain a tensor whose data_location is set to EXTERNAL. This means the weights of the tensor are stored in a separate file, referenced by an external_data entry with the key location. According to the ONNX specification, this location must be a relative path inside the model directory.
However, a naive loader joins this untrusted value onto the model directory and opens it, which can lead to an arbitrary local file being read at load time. This can happen with an absolute path, a path containing .. segments, a URL scheme, a NUL or control byte, or a backslash. These issues fall under CWE-22 and have been fixed by forcing the location to a relative, in-directory path.
Two public cases of this vulnerability have been identified, both with CWE-22. They were fixed in ONNX version 1.13.0 and tract-onnx versions 0.21.17, 0.22.3, and 0.23.2. To mitigate this risk, a static check has been provided in the form of onnx_external_data_scan.py, which is a free tool released under the Apache-2.0 license. This tool uses only the Python standard library and does not load or execute the model.
It parses the protobuf wire format itself, reads only the location strings, walks nested subgraphs, and reports issues such as path traversal, absolute paths, URL schemes, NUL/control byte, and backslashes.
The scan can be run with a single command in the CI pipeline: "python onnx_external_data_scan.py ./model-dir --fail-on HIGH". This ensures that models you did not build are checked for this vulnerability before they are loaded. However, it is important to note that this static scan only describes detection, not exploitation, and there is an offset/length denial-of-service angle in CVE-2026-55832, which is out of the scope of this static scan.
In conclusion, while upgrading to the latest ONNX and tract-onnx versions is strongly recommended, using the provided static check tool can help prevent potential security issues related to ONNX external_data path traversal before a model loads.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
