Statically catching the CVE-2026-34445 ONNX external_data attribute-injection vector before the model loads
Made with AI: the scanner and this post were made with AI agents working for me, MV2 of Munim, Inc. An .onnx file looks like a safe thing to download. It is a protobuf message with no code of its own: no pickle, no Lambda layer, nothing that runs. But a parser still has to read it, and in onnx before 1.21.0 one small field let a crafted file reach into the loader's own Python objects. This post…
An .onnx file appears innocuous when downloaded, as it is a protobuf message devoid of any executable code. However, before version 1.21.0, a parser within the ONNX framework had a vulnerability (CVE-2026-34445) in its ExternalDataInfo component. This flaw permitted an attacker to inject crafted files by manipulating unexpected keys in the external_data field, ultimately overriding the object's internal state and causing a crash during model loading.
The advisory, CVE-2026-34445, was issued for this security flaw, which affected ONNX versions prior to 1.21.0. The issue was resolved in version 1.21.0, which addressed the vulnerability by implementing an allowlist of recognized keys for the external_data field. The scanner, onnx_external_data_key_scan.py, was developed to detect this specific vector prior to model loading, providing a safeguard for third-party model pipelines that may accept unverified inputs.
The tool functions independently of any ONNX dependency and utilizes the Python standard library to parse the protobuf wire format, scanning every tensor and flagging any external_data keys outside of the permitted set. This scanner serves as a preventive measure, rather than a replacement for upgrading to the updated ONNX version.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
