Description

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-21T16:17:17.863Z",
  "pubdate": "2026-08-21T16:17:17.863Z",
  "executiveSummary": "An insecure file writing vulnerability exists in ONNX before 1.21.0 within the 'save_external_data' function, involving inadequate file path validation and race conditions during external data serialization.\nThe vulnerability allows a local attacker with write access to a target directory to exploit non-atomic file checks and symlink following behaviors.\nSuccessful exploitation enables arbitrary file write and overwrite capabilities, potentially leading to unauthorized modification of sensitive system or user files such as ~/.ssh/authorized_keys, cron jobs, or critical application configurations.\nThe attack requires local access, specific directory write permissions, and precise timing to intercept the victim's serialization process.\nThe risk implication is severe for shared hosting or multi-user environments where local privilege escalation or persistence can be achieved via file tampering.\nThe issue is officially remediated in ONNX version 1.21.0 through proper implementation of secure file creation flags.",
  "technicalDetails": "The vulnerability resides in the 'save_external_data' function within ONNX prior to version 1.21.0. The core root cause stems from insecure file handling practices during the external data serialization phase, where the application constructs the destination file path directly using the model's external_data location field.\nPrior to opening the file for writing, the vulnerable component performs a non-atomic 'os.path.isfile()' check to determine if the target file already exists. This creates a classic Time-of-Check to Time-of-Use (TOCTOU) race condition.\nBecause the file is opened for writing without secure flags such as O_NOFOLLOW and O_EXCL, the operating system will resolve and follow symbolic links encountered during the file open operation.\nThe attack flow proceeds as follows: First, a local attacker with write access to the directory where the victim process serializes external data identifies or anticipates the target filename. Second, the attacker pre-plants a symbolic link pointing to a sensitive file accessible to the victim's user context, such as ~/.ssh/authorized_keys, a system cron file, or critical application configuration files. Third, when the victim process executes 'save_external_data', it passes the non-atomic existence check because the symlink exists or bypasses logic checks, and subsequently opens the target path. Fourth, because the underlying system call follows the symlink without O_NOFOLLOW/O_EXCL protections, the victim's write operations append data directly to the attacker-controlled destination file.\nPrerequisites for this attack include local execution privileges, write access to the targeted working directory, and the ability to influence or predict the model's external_data location field.\nThe post-exploitation impact includes unauthorized data injection, persistence establishment via SSH key addition or scheduled task modification, and potential privilege escalation or configuration tampering depending on the privileges of the victim process executing the ONNX serialization."
}