Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-01 | 2 | Disclosure1Patch1 |
| 2026-04-02 | 2 | Disclosure2 |
🌊 CVE-2026-27489 (onnx): High path traversal via symlink—arbitrary file access. Patch: ONNX latest https://www.tenable.com/cve/newest https://nvd.nist.gov/vuln/detail/CVE-2026-27489 https://github.com/onnx/onnx/security/advisories
Post summary
CVE‑2026‑27489 enables path traversal via symlinks in ONNX, permitting arbitrary file access, and a patch is available in the latest ONNX release.
We found a zero-day path traversal in ONNX — CVE-2026-27489. It took three patches to get fixed. We break down how the vulnerability survived each fix and what it takes to actually kill a traversal bug. 👉 Full analysis: https://secdim.com/blog/post/two-incomplete-fixes-for-a-path-traversal-vulnerability-in-onnx-cve-2026-27489-18075/ #appsec #securecoding #onnx https://t.co/1mgKWVlKlQ
Post summary
The post discloses a zero‑day path traversal (CVE‑2026‑27489) in ONNX, summarizes that three patches were issued, and provides analysis of the vulnerability’s persistence and mitigation. It serves as a detailed disclosure rather than implying active exploitation.
CVE-2026-27489 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink all… https://www.cve.org/CVERecord?id=CVE-2026-27489
Post summary
The post announces a path‑traversal vulnerability in ONNX prior to version 1.21.0, with no PoC, exploit, or patch details provided.
🚨*CVE* CVE-2026-27489 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink all… https://www.cve.org/CVERecord?id=CVE-2026-27489 ----- Traducción: CVE-2026-27489 Ope… http://infoflow.cloud`
Post summary
The post announces CVE-2026-27489, a path traversal flaw in ONNX before version 1.21.0, linking to the CVE record but providing no PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | linuxfoundation | onnx | - | - | - |