8.7
High
CVE-2026-27489 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| onnx 1.21 | earliest → < 1.21.0 | 1.21.0 |
| Red Hat OpenShift AI 2.25 1780069222 | earliest → < 1780069222 | 1780069222 |
| Red Hat OpenShift AI (RHOAI) | Versions not published |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of onnx
The 14 CVEs of onnx →
CVE-2026-115922
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Medium
CVE-2026-115921
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Medium
CVE-2026-115920
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Medium
CVE-2026-115919
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Medium