Statically catching the CVE-2026-34445 ONNX external_data attribute-injection vector before the model loads

A developer at Munim, Inc. released a free, Apache-2.0 static scanner that detects the CVE-2026-34445 attribute-injection vector in ONNX models before any loader runs. The tool, shipped as v0.13.0 of keras-model-scan, flags unexpected keys in a tensor's external_data field, which in onnx versions before 1.21.0 were passed to setattr without validation and could overwrite a loader's internal state and crash a model-serving process at load time. The scanner uses only the Python standard library and never executes or loads the model, exiting non-zero when a finding at or above a configurable severity threshold is present so it can serve as a CI gate.

Made with AI: the scanner and this post were made with AI agents working for me, MV2 of Munim, Inc. An .onnx file looks like a safe thing to download. It is a protobuf message with no code of its own: no pickle, no Lambda layer, nothing that runs. But a parser still has to read it, and in onnx before 1.21.0 one small field let a crafted file reach into the loader's own Python objects. This post explains that field, the advisory, and a free static check that flags it before any loader runs. external data Big models keep their weights outside the .onnx file. A tensor whose data location is EXTERNAL names its weights file through a list of key/value string pairs in the tensor's external data field. The ONNX spec recognises only four keys: | key | meaning | |---|---| | location | path of the data file required | | offset | byte offset where the tensor's data begins | | length | number of bytes | | checksum | SHA1 digest of the data file | onnx = 1.21.0 also keeps basepath , for save/load round-trips. Before 1.21.0, onnx 's ExternalDataInfo read those pairs by calling setattr self, key, value for every key, without validating it. So a crafted model carrying an unexpected key a Python dunder such as class , or any other attribute name could overwrite the object's internal state and crash a model-serving process at load time. onnx < 1.21.0 onnx external data key scan.py I shipped a free, Apache-2.0 scanner for exactly this vector, released as v0.13.0 of keras-model-scan. It uses only the Python standard library and never executes or loads the model: {location, offset, length, checksum, basepath} as In CI, one line: python onnx external data key scan.py ./model-dir --fail-on HIGH The exit code is non-zero when a finding at or above --fail-on is present, so it works as a gate. Why a separate tool? Existing model scanners such as ModelScan and ModelAudit check ONNX custom ops and external data path traversal location pointing outside the model directory , but as far as I can tell not unexpected external data keys. So this appears to be the first standalone detector for this exact vector. If I have missed one, please tell me and I will correct this. Scanner and full write-up: https://github.com/munimtechnologies/keras-model-scan/blob/main/ONNX EXTERNAL DATA KEY SCAN.md https://github.com/munimtechnologies/keras-model-scan/blob/main/ONNX EXTERNAL DATA KEY SCAN.md repo: https://github.com/munimtechnologies/keras-model-scan https://github.com/munimtechnologies/keras-model-scan . Issues and corrections are welcome. MV2 of Munim, Inc.