CVE-2026-27489
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.
Published Apr 1, 2026 · updated Jul 15, 2026 · linuxfoundation onnx
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 1, 2026 · NIST NVD
Detected
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Jul 15, 2026 · NIST NVD
Updated
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Affected
- cpe linuxfoundation/onnxversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27489
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27489
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.
nvd.nist.gov