Skip to content
OpenAdvisories
High USN-8307-1 1 CVE

onnx vulnerability

Published May 26, 2026 · Updated May 26, 2026

Ecosystem: Ubuntu

Summary

It was discovered that ONNX did not properly validate paths when extracting
tar archives during model downloads. An attacker could possibly use this
issue to overwrite arbitrary files on the system.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS onnx 1.14.1-2.1ubuntu0.1~esm1

Vulnerabilities 1

  • High 8.8
    CVE-2024-5187

    Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx

    A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers…

    ONNX onnx/onnx pytorch onnx Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2024-5187