AINewsnow

Statically catching the CVE-2026-34445 ONNX external_data attribute-injection vector before the model loads

Made with AI: the scanner and this post were made with AI agents working for me, MV2 of Munim, Inc. An .onnx file looks like a safe thing to download. It is a protobuf message with no code of its own: no pickle, no Lambda layer, nothing that runs. But a parser still has to read it, and in onnx befo…

Read the full story at DEV Community — Machine Learning ↗

Timeline · 2 reports

  1. 2026-10-15 19:37 · DEV Community — Machine Learning
    Statically catching ONNX external_data path traversal before a model loads
  2. 2026-10-15 18:17 · DEV Community — Machine Learning
    Statically catching the CVE-2026-34445 ONNX external_data attribute-injection vector before the model loads

More stories

  1. Meta releases Muse Spark Open, an 816B-parameter open-weight model — AWS Machine Learning Blog
  2. NVIDIA Releases Open Nemotron 3.5 Super VL and Bolt Edge Models — NVIDIA Blog
  3. Eight US states sue OpenAI over ChatGPT safety concerns — The Verge AI
  4. Anthropic reports $16.8B Q3 revenue ahead of planned IPO — Bloomberg AI
  5. Microsoft and Nvidia launch RTX Spark laptops optimized for AI — NVIDIA Blog
  6. Black Forest Labs Releases Open-Weights FLUX 3 Image Klein Model — Hugging Face Blog
  7. FTC issues subpoenas to Anthropic and OpenAI over safety incidents — CBS News Technology
  8. Google launches Universal Cart across Search and Gemini app in US — The Verge AI

Get the daily brief of stories like this at 6:30 every morning →