An attacker who can write to the directory used by the ONNX 'save_external_data' function can pre‑plant a symbolic link that points to a target file the victim can write to, such as the user’s SSH authorized_keys or cron files. When the victim later serializes the model, the library opens the target path for writing without checking for existing symbolic links or using an exclusive-open flag, causing the victim’s write to append to the target file. This allows the attacker to inject commands or configurations that will be executed by the victim, effectively granting local arbitrary file write and potential privilege escalation.

ONNX, the open‑source machine‑learning framework, is affected in all releases prior to 1.21.0. Any deployment that uses an older ONNX version and enables the 'save_external_data' feature is vulnerable.

The CVSS score of 6.8 indicates a moderate severity vulnerability that can be exploited by a local attacker. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to have write access to the directory where the external data is serialized, making the threat most relevant in environments where untrusted code can place models or where the directory is world‑writable. Once exploited, the attacker can append data to arbitrary writable files, including SSH keys, cron jobs, and application configuration files, potentially achieving full control over the affected system.