CVE-2026-28500
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
Impact
## What's the issue Passing `silent=True` to `onnx.hub.load()` kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness. ```python if not _verify_repo_ref(repo) and not silent: # completely skipped when silent=True print("The model repo... is not trusted") if input().lower() != "y": return None ``` On top of that, the SHA256 integrity check is useless here — it validates against a manifest that lives in the same repo the attacker controls, so the hash will always match. ## Impact Any pipeline using `hub.load()` with `silent=True` and an external repo string is silently loading whatever the repo owner ships. If that model executes arbitrary code on load, the attacker has access to the machine. ## Resolved by removing the feature ## References - [Write-up](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | onnx | <= 1.20.1 | 1.21.0rc1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Onnx | through 1.20.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md
- https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/security/cve/CVE-2026-28500
- https://bugzilla.redhat.com/show_bug.cgi?id=2448518
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json
- https://github.com/advisories/GHSA-hqmj-h5c6-369m
- https://nvd.nist.gov/vuln/detail/CVE-2026-28500
- https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml