Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-28500 is a high-severity vulnerability in the onnx Python package's onnx.hub.load() function, present in versions up to 1.20.1. The vulnerability arises from improper logic in the repository trust verification mechanism when the silent=True parameter is used. Normally, the function warns users when loading models from untrusted sources and requests confirmation. However, with silent=True, all security warnings and prompts are suppressed, allowing automatic loading of models from attacker-controlled repositories without user awareness."}, {'type': 'paragraph', 'content': 'An attacker can supply a malicious model with a matching valid SHA256 hash, bypassing integrity checks. This creates a silent supply-chain attack vector where malicious models can be loaded and executed without notification. When combined with file-system vulnerabilities, attackers can exfiltrate sensitive data such as SSH keys and cloud credentials immediately upon model loading.'}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can lead to a silent supply-chain attack where malicious machine learning models are loaded without user knowledge or consent. Attackers can exploit this to execute malicious code or actions on the victim's machine."}, {'type': 'list_item', 'content': 'Exfiltration of sensitive files such as SSH keys and cloud credentials.'}, {'type': 'list_item', 'content': 'No privileges or user interaction are required for the attack, making it easy to exploit.'}, {'type': 'list_item', 'content': 'The attack has a high confidentiality impact but does not affect integrity or availability.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the use of the onnx.hub.load() function with the silent=True parameter, which suppresses security warnings and prompts when loading models from untrusted repositories.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your system or network, you can monitor for usage of onnx.hub.load() calls that include the silent=True parameter, especially when loading models from non-official or unknown repositories.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is triggered by Python code execution, you can search your codebase or running processes for invocations of onnx.hub.load with silent=True.'}, {'type': 'list_item', 'content': 'Use grep or similar tools to find occurrences in your code: grep -r "onnx.hub.load" . | grep "silent=True"'}, {'type': 'list_item', 'content': 'Monitor Python process command lines or logs for suspicious model loading from untrusted sources.'}, {'type': 'list_item', 'content': 'Check network traffic for connections to unknown GitHub repositories or suspicious download activity related to ONNX models.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

As no patched versions are currently available, immediate mitigation involves avoiding the use of the silent=true parameter in onnx.hub.load() to ensure that security warnings and confirmation prompts are not suppressed.

Additionally, only load ONNX models from trusted, official repositories to reduce the risk of supply-chain attacks.

Implement monitoring to detect any unexpected or silent model loading activities.

Consider restricting network access to untrusted GitHub repositories or applying application-level controls to prevent automatic downloads from unknown sources.

Useful 0 Not Useful 0