{"schemaVersion":3,"id":"CVE-2026-28500","aliases":["GHSA-hqmj-h5c6-369m","PYSEC-2026-103","UBUNTU-CVE-2026-28500","DEBIAN-CVE-2026-28500","CGA-237h-pcm4-9vg9","CGA-6vfg-jhjj-x4wh","CGA-7j9c-j673-j35x","CGA-c5cr-64cm-hfx4","CGA-f44w-mpr2-3vhh","CGA-g7hm-4rpg-3wmx","CGA-gc8v-6622-jpj7","CGA-r73p-wxfr-h5qx","CGA-rhgp-7g68-6hc7"],"status":"published","duplicateOf":null,"title":null,"description":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely suppresses all security warnings and confirmation prompts. This vulnerability transforms a standard model-loading function into a vector for Zero-Interaction Supply-Chain Attacks. When chained with file-system vulnerabilities, an attacker can silently exfiltrate sensitive files (SSH keys, cloud credentials) from the victim's machine the moment the model is loaded. As of time of publication, no known patched versions are available.","dates":{"published":"2026-03-18T01:15:07.644Z","modified":"2026-07-15T01:11:41.016Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.1,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":10,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":8.6,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","exploitability":10,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00324,"percentile":0.23986,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.005999999999999972,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00318},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00324,"percentile":0.23986}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00318,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00312,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00324,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00324,"percentile":0.23986}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity","description":"The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/345.html"},{"id":"CWE-494","name":"Download of Code Without Integrity Check","description":"The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/494.html"},{"id":"CWE-693","name":"Protection Mechanism Failure","description":"The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.","type":"weakness","status":"Draft","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/693.html"},{"id":"CWE-829","name":"Inclusion of Functionality from Untrusted Control Sphere","description":"The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/829.html"}],"affected":[{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.10-onnx","name":"py3.10-onnx","label":"py3.10-onnx","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.10-onnx","purlType":"apk","versions":[{"text":"< 1.21.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-onnx","name":"py3.11-onnx","label":"py3.11-onnx","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-onnx","purlType":"apk","versions":[{"text":"< 1.21.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-onnx","name":"py3.12-onnx","label":"py3.12-onnx","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-onnx","purlType":"apk","versions":[{"text":"< 1.21.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-onnx","name":"py3.13-onnx","label":"py3.13-onnx","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-onnx","purlType":"apk","versions":[{"text":"< 1.21.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"onnx","name":"onnx","label":"onnx","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/onnx","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"onnx","name":"onnx","label":"onnx","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/onnx","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"linuxfoundation","product":"onnx","name":"onnx","label":"onnx","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.20.1","eol":null,"hubHref":"/vendor/linuxfoundation/onnx"},{"vendor":"onnx","product":"onnx","name":"onnx","label":"onnx","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.20.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.20.1","eol":null,"hubHref":"/vendor/onnx/onnx"},{"vendor":"PyPI","product":"onnx","name":"onnx","label":"onnx","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/onnx","purlType":"pypi","versions":[{"text":"< 1.21.0rc1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.0rc1","eol":null,"hubHref":null}],"affectedCount":10,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m","label":"github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","REPORT","Vendor Advisory"]},{"url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md","label":"github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28500","label":"access.redhat.com/security/cve/CVE-2026-28500","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448518","label":"bugzilla.redhat.com/show_bug.cgi?id=2448518","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","label":"access.redhat.com/errata/RHSA-2026:24977","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28500","label":"nvd.nist.gov/vuln/detail/CVE-2026-28500","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/onnx/onnx","label":"github.com/onnx/onnx","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-28500","label":"ubuntu.com/security/CVE-2026-28500","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28500","label":"www.cve.org/CVERecord?id=CVE-2026-28500","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-28500","label":"security-tracker.debian.org/tracker/CVE-2026-28500","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28500.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28500.json","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-X7FC-8M86-JX94"]},"timeline":[{"kind":"published","date":"2026-03-18T01:15:07.644Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-15T01:11:41.016Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:34:23.796Z","stale":false,"partial":false}}