Compliance Impact

This vulnerability allows an attacker to perform arbitrary file reads on the victim’s machine by exploiting hardlinks in malicious ONNX models. Such unauthorized access to sensitive files could lead to the exposure of confidential information.

In contexts where sensitive data is handled, such as AI supply chains or platforms hosting machine learning models, this could result in violations of data protection regulations like GDPR or HIPAA, which mandate strict controls over the confidentiality and security of personal and health-related data.

Therefore, the vulnerability poses a risk to compliance with these standards by potentially enabling data breaches through unauthorized file access.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the ONNX library to version 1.21.0 or later, where this vulnerability has been patched.

Until the upgrade is applied, avoid loading ONNX models from untrusted sources, especially those that might contain hardlinks or external data references.

Implement file system monitoring to detect and prevent the presence of hardlinks in directories used for ONNX models.

Consider restricting user permissions and access controls to limit the ability to create or use hardlinks in sensitive environments.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-34446 is a vulnerability in the ONNX library's onnx.load function, present in versions up to 1.20.1 and fixed in 1.21.0. The issue occurs because the code tries to prevent path traversal attacks by checking for symbolic links (symlinks), but it completely misses hardlinks. Hardlinks appear as regular files on the filesystem and share the same inode, so the security check does not detect them.

This flaw allows an attacker to craft malicious ONNX models containing external data references via hardlinks, which can bypass security checks and enable arbitrary file reads on the victim’s machine.

The vulnerability is related to improper limitation of pathname to restricted directories (CWE-22) and insufficient handling of symbolic links (CWE-61).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform arbitrary file reads on your machine by exploiting the failure to detect hardlinks in malicious ONNX models.

In practical terms, this means sensitive information could be silently exfiltrated without your awareness, especially in AI supply chain contexts where models are shared or downloaded from platforms like HuggingFace.

The attack requires local access and user interaction, and has a moderate severity with a CVSS score of 4.7.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the presence of hardlinks in ONNX model files that bypass the symlink checks in the onnx.load function. To detect potential exploitation, you can look for ONNX model files that contain hardlinks or unusual inode link counts.

On a Unix-like system, you can use the following commands to identify hardlinks in directories containing ONNX models:

• Use 'find' to locate files with multiple hardlinks (link count > 1): find /path/to/models -type f -links +1 -exec ls -li {} +
• Check inode numbers to find files sharing the same inode (indicating hardlinks): ls -li /path/to/models | sort -k1,1 | uniq -d -w 10

Additionally, monitoring for suspicious ONNX model files that reference external data or unusual file access patterns during model loading could help detect exploitation attempts.

Useful 0 Not Useful 0