~ / search / GHSA-h36j-8vv3-cj52

GHSA-h36j-8vv3-cj52

Open Neural Network Exchange (ONNX) Path Traversal Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-7776

Packages

EcosystemPackageAffectedFixed in
PyPI onnx < 1.17.0 1.17.0

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.

References

External links from the advisory. They lead to third-party sites.