ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

Vulnerability

Overview

CVE-2026-28500 affects the Open Neural Network Exchange (ONNX) library up to version 1.20.1. The vulnerability resides in the onnx.hub.load() function, which is designed to warn users when loading models from non-official repositories. However, due to improper logic in the repository trust verification mechanism, passing the _verify_repo_ref(), passing the silent=True parameter completely suppresses all security warnings and confirmation prompts [1][4]. This effectively bypasses the intended security control, allowing models to be downloaded from any unverified GitHub repository without user awareness.

Exploitation

Vector

An attacker can host a malicious ONNX model in a public repository and trick a victim into loading it via hub.load() with silent=True. The trust check is entirely skipped when silent=True is set, and the SHA256 integrity check is rendered useless because the manifest file used for validation resides in the same attacker-controlled repository [4]. This creates a zero-interaction supply-chain attack vector: the victim's code silently downloads and loads the malicious model without any prompt or warning.

Impact

If the loaded model executes arbitrary code upon loading (e.g., through custom operators or deserialization exploits), the attacker gains immediate gains access to the victim's machine. When chained with file-system vulnerabilities, sensitive files such as SSH keys and cloud credentials can be exfiltrated silently [1]. The attack requires no user interaction beyond the initial model load, making it particularly dangerous in automated pipelines or CI/CD environments.

Mitigation

Status

As of the publication date, no patched version of ONNX is available [1]. The official advisory indicates the issue is resolved by removing the silent feature entirely [4]. Users are advised to avoid using silent=True with hub.load()` and to only load models from trusted, verified repositories until a patched release is issued.