In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens… (CVE-2026-49114)

In ONNX before version 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without using secure flags like O_NOFOLLOW or O_EXCL. This occurs after a non-atomic os.path.isfile() check, creating a race condition. A local attacker with write permissions in the target directory can pre-plant a symbolic link that the victim process follows, causing arbitrary file writes. This can lead to unauthorized modification of sensitive files such as SSH authorized_keys, cron jobs, or application configuration files. The vulnerability is addressed in ONNX 1.21.0.

The vulnerability allows a local attacker with write access to the directory where ONNX serializes external data to cause the victim process to append data to arbitrary files. This can lead to privilege escalation or persistent unauthorized access by modifying critical files like SSH authorized_keys or cron files. The CVSS score of 7.1 reflects a medium severity with high impact on integrity and availability but requires local access and user interaction.

Upgrade ONNX to version 1.21.0 or later, where this vulnerability is fixed. Until then, restrict write permissions on directories used for external data serialization to trusted users only. Avoid running ONNX serialization in directories writable by untrusted users. Patch status is confirmed fixed in ONNX 1.21.0.