CVE-2026-49114 in ONNX
Summary
by MITRE • 08/21/2026
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in ONNX versions prior to 1.21.0 represents a classic Time-of-Check-to-Time-of-Use race condition combined with insecure file handling practices that can lead to arbitrary file write and potential remote code execution. The core technical flaw resides within the save_external_data function, which is responsible for serializing large model weights into external data files. When this function executes, it first performs a non-atomic check using os.path.isfile() to determine if the target path already exists. This initial step creates a window of opportunity for an attacker because there is no guarantee that the file system state remains unchanged between the time of the existence check and the subsequent file opening operation. Following this flawed verification, the function proceeds to open the specified external-data file location for writing without employing critical safety flags such as O_NOFOLLOW or O_EXCL. The absence of these flags means that if a symbolic link exists at the target path during the actual write operation, the operating system will follow the symlink rather than treating it as a regular file error condition.
This architectural weakness allows a local attacker with write access to the directory where the victim application serializes its external data to execute a deterministic pre-planting attack. By creating a symbolic link in that specific directory before the ONNX model serialization process begins, an attacker can redirect the output intended for the legitimate external data file toward any other location on the filesystem where the victim user possesses write permissions. Because the symlink is followed during the write operation, the content meant to be part of the machine learning model is instead appended or written into sensitive system files. This mechanism bypasses standard permission checks because the attacker does not need direct write access to the target file; they only require control over the directory containing the temporary output path and the ability to create symlinks within it.
The operational impact of this vulnerability is severe, as it enables privilege escalation and remote code execution through common configuration files. An attacker can manipulate critical system components by writing malicious content into authorized_keys files located in user home directories, thereby gaining unauthorized SSH access without a password. Similarly, the ability to write to cron job configurations allows for persistent command execution at scheduled intervals, while modification of application-specific configuration files can alter runtime behavior or inject malicious logic into subsequent executions. The deterministic nature of this attack means that success is highly reliable provided the attacker has sufficient control over the directory structure and timing relative to the victim's serialization process. This aligns with CWE-59 Improper Link Resolution Before File Access, commonly known as a symlink race condition, which highlights the danger of relying on file existence checks without atomic operations or secure open flags.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK techniques related to persistence and privilege escalation via system configuration modification. The exploitation path involves creating symbolic links (T1542) followed by writing malicious content to authorized_keys (T1098.003) or cron jobs (T1053.003). To mitigate this risk, organizations must upgrade ONNX to version 1.21.0 or later where the save_external_data function has been patched to use atomic file operations and secure flags that prevent symlink following. In environments where upgrading is not immediately feasible, administrators should restrict write permissions on directories used for temporary model serialization to only trusted processes and avoid running ML workloads under accounts with broad filesystem write access. Additionally, implementing strict security policies such as disabling symbolic link creation in sensitive directories or using mount options like nosymlinks can provide an additional layer of defense against this class of file system manipulation attacks.