GHSA-h36j-8vv3-cj52

Source

https://github.com/advisories/GHSA-h36j-8vv3-cj52

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-h36j-8vv3-cj52/GHSA-h36j-8vv3-cj52.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h36j-8vv3-cj52

Aliases

Published

2025-03-20T12:32:46Z

Modified

2025-03-27T17:52:58.403634Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Open Neural Network Exchange (ONNX) Path Traversal Vulnerability

Details

A vulnerability in the download_model function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.

Database specific

{
    "nvd_published_at": "2025-03-20T10:15:37Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T21:16:01Z"
}

References

Affected packages

PyPI / onnx

Package

Name: onnx; View open source insights on deps.dev
Purl: pkg:pypi/onnx

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.17.0

Affected versions

0.*

0.1

0.2

0.2.1

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.6.0

1.7.0

1.8.0

1.8.1

1.9.0

1.10.0

1.10.1

1.10.2

1.11.0

1.12.0

1.13.0

1.13.1

1.14.0

1.14.1

1.15.0

1.16.0

1.16.1

1.16.2