Database/AI/ML frameworks & serving
ONNX: Directory traversal via `external_data` field in the tensor proto
CVE-2022-25882AI/ML frameworks & servingcurated
Impact
Directory traversal via external_data field in the tensor proto
Who can reach it
Customer-supplied ONNX model file
What to do
Upgrade onnx >= 1.13.0. Every ONNX ingest path must resolve external-data paths against a jail
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.