The vulnerability exists in the ONNX library's onnx.hub.load() function. In versions up to 1.20.1 the function's logic that checks whether a model repository is trusted incorrectly allows the warning that normally alerts users when loading a model from a non‑official source to be suppressed if the caller passes silent=True. As a result, a malicious model can be loaded without the user seeing any warning. Together with a filesystem read or write flaw, the attacker could use this silent loading to exfiltrate sensitive files such as SSH keys or cloud credentials. The weakness is reflected in CWE‑345 (Missing Authorization), CWE‑494 (Exposed Functionality), CWE‑693 (Improper Handling of Secrets), and CWE‑829 (Privilege Escalation).

Affected are the ONNX library supplied by the Linux Foundation, any release version 1.20.1 or earlier. The Common Platform Enumeration for the product is cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*. No patched release is available at the time of the advisory.

The issue has a CVSS score of 8.6, indicating high severity. The EPSS score is below 1%, suggesting that widespread exploitation is not yet common. It is not listed in the CISA KeV catalog. Exploitation requires an attacker to cause a program to call onnx.hub.load() with silent=True and provide a model from an untrusted repository. If the victim’s system also contains a file‑system weakness that permits reading of sensitive files, the attacker could combine the two flaws to retrieve such data. The risk therefore increases if an application that automatically loads ONNX models is compromised or if an attacker can supply the model URL.