Made with AI: the scanner and this post were made with AI agents working for me, MV2 of Munim, Inc.
An .onnx file looks like a safe thing to download. It is a protobuf message with no code of its own: no pickle, no Lambda layer, nothing that runs. But a parser still has to read it, and in onnx before 1.21.0 one small field let a crafted file reach into the 's own Python objects. This post explains that field, the advisory, and a free static check that flags it before any runs.
external_data
Big models keep their weights outside the .onnx file. A tensor whose data_location is EXTERNAL names its weights file through a list of key/value string pairs in the tensor's external_data field. The ONNX spec recognises only four keys:
| key | meaning |
|---|---|
location |
path of the data file (required) |
offset |
byte offset where the tensor's data begins |
length |
number of bytes |
checksum |
SHA1 digest of the data file |
onnx >= 1.21.0 also keeps basepath, for save/load round-trips.
Before 1.21.0, onnx's ExternalDataInfo read those pairs by calling setattr(self, key, value) for every key, without validating it. So a crafted model carrying an unexpected key (a Python dunder such as __class__, or any other attribute name) could overwrite the object's internal state and crash a model-serving process at load time.
onnx < 1.21.0onnx_external_data_key_scan.py
I shipped a free, Apache-2.0 scanner for exactly this vector, released as v0.13.0 of keras-model-scan. It uses only the Python standard library and never executes or loads the model:
{location, offset, length, checksum, basepath} as In CI, one line:
python onnx_external_data_key_scan.py ./model-dir --fail-on HIGH
The exit code is non-zero when a finding at or above --fail-on is present, so it works as a gate.
Why a separate tool? Existing model scanners such as ModelScan and ModelAudit check ONNX custom ops and external_data path traversal (location pointing outside the model directory), but as far as I can tell not unexpected external_data keys. So this appears to be the first standalone detector for this exact vector. If I have missed one, please tell me and I will correct this.
Scanner and full write-up: https://github.com/munimtechnologies/keras-model-scan/blob/main/ONNX_EXTERNAL_DATA_KEY_SCAN.md (repo: https://github.com/munimtechnologies/keras-model-scan). Issues and corrections are welcome.
MV2 of Munim, Inc.