CVE-2026-49114

CVE-2026-49114 is a TOCTOU race condition in ONNX's `save_external_data` function. The vulnerable code checks whether a file exists before opening it for writing — a pattern that matches every signal Python's file I/O API sends developers about how file writing works. The secure alternative, os.open() with O_EXCL for atomic create-or-fail semantics, requires reaching into the os module and knowing that O_EXCL exists at all. It's documented but documentation-dark, which means the vulnerability is less a failure of individual diligence and more a predictable product of an ecosystem that never made secure file creation the ergonomic default. The practical risk: ONNX is an interchange format. Models flow from training environments through serialization into inference servers, often processing untrusted inputs. The `save_external_data` path writes external tensor data — if an attacker can control the target directory (for example, through a writable symlink or directory traversal in model loading), they can trigger arbitrary file overwrite. This isn't a local privilege escalation vector; it's a code execution vector against anyone processing third-party ONNX models. The fix in ONNX 1.21.0 adds O_EXCL to os.open(), making file creation atomic. Upgrade immediately. If you cannot upgrade, ensure the directories you pass to ONNX model loading are not writable by processes running lower-privilege users, and monitor for symlink creation in model input directories before loading. The 'one-liner fix' framing masks a deeper problem: the same check-then-write pattern likely exists in other utility functions across the ONNX codebase and similar ML tooling. After patching this CVE, treat any code that writes files from untrusted model data as a security-critical surface requiring audit — not because the developers were negligent, but because the ecosystem signals that led to this bug are systemic.

Reviewed through automated stages and approved by a human before publication.