Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/onnx@1.14.0
Typepypi
Namespace
Nameonnx
Version1.14.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.21.0
Latest_non_vulnerable_version1.21.0
Affected_by_vulnerabilities
0
url VCID-2p7h-ajfk-uugy
vulnerability_id VCID-2p7h-ajfk-uugy
summary Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.
references
0
reference_url https://github.com/onnx/onnx
reference_id
reference_type
scores
url https://github.com/onnx/onnx
1
reference_url https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-222.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-222.yaml
3
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY
4
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
5
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
7
reference_url https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-27318
reference_id CVE-2024-27318
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-27318
9
reference_url https://github.com/advisories/GHSA-whh8-fjgc-qp73
reference_id GHSA-whh8-fjgc-qp73
reference_type
scores
url https://github.com/advisories/GHSA-whh8-fjgc-qp73
fixed_packages
0
url pkg:pypi/onnx@1.16.0
purl pkg:pypi/onnx@1.16.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7djm-gpg9-yfgg
1
vulnerability VCID-u796-p1fa-ubf5
2
vulnerability VCID-vufm-7t73-xfgt
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.16.0
aliases CVE-2024-27318, GHSA-whh8-fjgc-qp73, PYSEC-2024-222
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2p7h-ajfk-uugy
1
url VCID-7djm-gpg9-yfgg
vulnerability_id VCID-7djm-gpg9-yfgg
summary Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.
references
0
reference_url https://github.com/onnx/onnx/security/advisories/GHSA-p433-9wv8-28xj
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://github.com/onnx/onnx/security/advisories/GHSA-p433-9wv8-28xj
fixed_packages
0
url pkg:pypi/onnx@1.21.0
purl pkg:pypi/onnx@1.21.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.21.0
aliases CVE-2026-34447, GHSA-p433-9wv8-28xj, PYSEC-2026-104
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7djm-gpg9-yfgg
2
url VCID-mz2c-nefk-8ffx
vulnerability_id VCID-mz2c-nefk-8ffx
summary Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.
references
0
reference_url https://github.com/onnx/onnx
reference_id
reference_type
scores
url https://github.com/onnx/onnx
1
reference_url https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
url https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-223.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-223.yaml
3
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY
4
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
5
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL
reference_id
reference_type
scores
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-27319
reference_id CVE-2024-27319
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2024-27319
8
reference_url https://github.com/advisories/GHSA-h8wv-9h96-m4hr
reference_id GHSA-h8wv-9h96-m4hr
reference_type
scores
url https://github.com/advisories/GHSA-h8wv-9h96-m4hr
fixed_packages
0
url pkg:pypi/onnx@1.16.0
purl pkg:pypi/onnx@1.16.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7djm-gpg9-yfgg
1
vulnerability VCID-u796-p1fa-ubf5
2
vulnerability VCID-vufm-7t73-xfgt
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.16.0
aliases CVE-2024-27319, GHSA-h8wv-9h96-m4hr, PYSEC-2024-223
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mz2c-nefk-8ffx
3
url VCID-u796-p1fa-ubf5
vulnerability_id VCID-u796-p1fa-ubf5
summary Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available.
references
0
reference_url https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
1
reference_url https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
fixed_packages
0
url pkg:pypi/onnx@1.21.0rc1
purl pkg:pypi/onnx@1.21.0rc1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7djm-gpg9-yfgg
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.21.0rc1
aliases CVE-2026-28500, GHSA-hqmj-h5c6-369m, PYSEC-2026-103
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u796-p1fa-ubf5
4
url VCID-vufm-7t73-xfgt
vulnerability_id VCID-vufm-7t73-xfgt
summary A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution.
references
0
reference_url https://huntr.com/bounties/a7a46cf6-1fa0-454b-988c-62d222e83f63
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
url https://huntr.com/bounties/a7a46cf6-1fa0-454b-988c-62d222e83f63
fixed_packages
0
url pkg:pypi/onnx@1.16.2
purl pkg:pypi/onnx@1.16.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7djm-gpg9-yfgg
1
vulnerability VCID-u796-p1fa-ubf5
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.16.2
aliases CVE-2024-7776, PYSEC-2025-10
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vufm-7t73-xfgt
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/onnx@1.14.0