{"data":{"id":"6387b784-7763-4f32-97cd-cd1650bd1555","title":"CVE-2024-7776: A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1…","summary":"CVE-2024-7776 affects the `download_model` function in the onnx/onnx framework, before and including version 1.16.1. Path traversal is not adequately prevented when processing malicious tar files, allowing arbitrary file overwrite in the user's directory. The source states this could potentially lead to remote command execution.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-7776","publishedAt":"2025-03-20T14:15:37.520Z","cveId":"CVE-2024-7776","cweIds":["CWE-22"],"cvssScore":"9.1","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["onnx@< 1.17.0 (fixed: 1.17.0)"],"affectedPackageNames":["onnx"],"affectedPackageRefs":["pypi:onnx"],"affectedVendors":[],"affectedVendorsRaw":["ONNX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"onnx download_model arbitrary file overwrite via path traversal in tar files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01532,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-h36j-8vv3-cj52"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:15.062Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-10-01T21:45:45.778Z","daysToFix":-170,"fixCheckedAt":"2026-10-29T21:44:53.844Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"onnx","fixedVersion":"1.17.0","matchedVersion":"1.17.0","fixReleasedAt":"2024-10-01T21:45:45.778Z","daysToFix":-170,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:53.694Z"}]}}