CVE-2026-34447
Fixed in a distro release EPSS <1%CVSS 5.5
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.
Products: onnx
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | onnx | 1.21.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | py3.10-onnx | 1.21.0-r0 |
| Chainguard | py3.11-onnx | 1.21.0-r0 |
| Chainguard | py3.12-onnx | 1.21.0-r0 |
| Chainguard | py3.13-onnx | 1.21.0-r0 |
| Debian 12 | onnx | no fix |
| Debian 13 | onnx | no fix |
| Debian 14 | onnx | no fix |
| Ubuntu 22.04 LTS | onnx | no fix |
| Ubuntu 25.10 | onnx | no fix |
| Ubuntu 26.04 LTS | onnx | no fix |
| Ubuntu 26.10 | onnx | no fix |
| Ubuntu Pro 24.04 LTS | onnx | no fix |
| Wolfi | py3.10-onnx | 1.21.0-r0 |
| Wolfi | py3.11-onnx | 1.21.0-r0 |
| Wolfi | py3.12-onnx | 1.21.0-r0 |
| Wolfi | py3.13-onnx | 1.21.0-r0 |