{"id":"CVE-2026-28500","aliases":["GHSA-hqmj-h5c6-369m","PYSEC-2026-103"],"url":"https://o3.security/vulnerability/CVE-2026-28500","summary":"ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack","details":"## What's the issue\nPassing `silent=True` to `onnx.hub.load()` kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness.\n \n```python\nif not _verify_repo_ref(repo) and not silent:\n    # completely skipped when silent=True\n    print(\"The model repo... is not trusted\")\n    if input().lower() != \"y\":\n        return None\n```\n \nOn top of that, the SHA256 integrity check is useless here — it validates against a manifest that lives in the same repo the attacker controls, so the hash will always match.\n\n \n## Impact\nAny pipeline using `hub.load()` with `silent=True` and an external repo string is silently loading whatever the repo owner ships. If that model executes arbitrary code on load, the attacker has access to the machine.\n \n## Resolved by removing the feature \n## References\n \n- [Write-up](https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md)","published":"2026-03-18T01:15:07.644Z","modified":"2026-08-12T03:51:40.639415276Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":{"score":0.00318,"percentile":0.24769,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"onnx","fixedVersion":"1.21.0rc1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-28500.md"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28500.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-28500"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28500.json"},{"type":"ADVISORY","url":"https://github.com/onnx/onnx/security/advisories/GHSA-hqmj-h5c6-369m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28500"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448518"},{"type":"PACKAGE","url":"https://github.com/onnx/onnx"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2026-103.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.639415276Z"}}