CVE-2024-5187 — HIGH (CVSS 8.8) AI Security Vulnerability

Q: What systems are affected by CVE-2024-5187?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps/CI-CD pipelines, model registries.

Q: What is the CVSS score for CVE-2024-5187?

CVE-2024-5187 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 1.36%.

CISO Take

ONNX versions before 1.16.2 allow arbitrary file overwrite via malicious tar archives when calling download_model_with_test_data, enabling RCE through SSH key injection or cron job tampering. Patch to onnx>=1.16.2 immediately and audit any automated pipeline that fetches ONNX models from external or untrusted sources. Apply container isolation and restrict filesystem write permissions for all ML workloads as defense-in-depth.

Risk Assessment

CVSS 8.8 High with network reachability and no privilege requirement. The 'user interaction required' rating is misleading in ML contexts: automated CI/CD pipelines and model download scripts eliminate this barrier entirely, making exploitation effectively zero-click in common deployments. EPSS of 1.4% reflects low current active exploitation, but path traversal via tar is a trivial, well-documented technique requiring no ML expertise. Any ONNX deployment that automates model fetching from external sources is at high risk of full host compromise.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
onnx	pip	< 1.16.2	`1.16.2`
20.8K OpenSSF 8.1 1.1K dependents Pushed 6d ago 90% patched ~29d to patch Full package profile →

Do you use onnx? You're affected.

Severity & Risk

CVSS 3.1

8.8 / 10

EPSS

1.4%

chance of exploitation in 30 days

Higher than 80% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

Recommended Action

6 steps

Patch immediately: upgrade to onnx>=1.16.2.
Audit codebases for any calls to download_model_with_test_data or custom tar extraction code using ONNX <1.16.2.
Only ingest ONNX models from cryptographically verified, internally mirrored sources — validate SHA256 checksums before any extraction.
Run ML workloads in containers with read-only host mounts and minimal filesystem permissions; no Python process should have write access outside its working directory.
Detection: alert on unexpected writes to ~/.ssh/, /etc/cron.d/, /etc/sudoers.d/, or /etc/passwd originating from Python or ONNX processes.
Implement pre-extraction scanning of tar/zip archives in any pipeline that ingests external model files.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Supply Chain Code Execution Framework Model AML.T0002.001 - Models AML.T0010.001 - AI Software AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts

Compliance Impact

This CVE is relevant to:

EU AI Act

Art.15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - Supply Chain for AI Systems

NIST AI RMF

MANAGE-2.2 - Treatments, Responses, and Adjustments for AI Risks

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2024-5187?

ONNX versions before 1.16.2 allow arbitrary file overwrite via malicious tar archives when calling download_model_with_test_data, enabling RCE through SSH key injection or cron job tampering. Patch to onnx>=1.16.2 immediately and audit any automated pipeline that fetches ONNX models from external or untrusted sources. Apply container isolation and restrict filesystem write permissions for all ML workloads as defense-in-depth.

Is CVE-2024-5187 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-5187, increasing the risk of exploitation.

How to fix CVE-2024-5187?

1. Patch immediately: upgrade to onnx>=1.16.2. 2. Audit codebases for any calls to download_model_with_test_data or custom tar extraction code using ONNX <1.16.2. 3. Only ingest ONNX models from cryptographically verified, internally mirrored sources — validate SHA256 checksums before any extraction. 4. Run ML workloads in containers with read-only host mounts and minimal filesystem permissions; no Python process should have write access outside its working directory. 5. Detection: alert on unexpected writes to ~/.ssh/, /etc/cron.d/, /etc/sudoers.d/, or /etc/passwd originating from Python or ONNX processes. 6. Implement pre-extraction scanning of tar/zip archives in any pipeline that ingests external model files.

What systems are affected by CVE-2024-5187?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps/CI-CD pipelines, model registries.

What is the CVSS score for CVE-2024-5187?

CVE-2024-5187 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 1.36%.

Technical Details

NVD Description

A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, versions before 1.16.2, allow for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.

Exploitation Scenario

An adversary publishes a malicious ONNX model to a public repository or a compromised internal model registry. The tar archive embedded in the model package contains a file entry with an absolute path such as /home/mluser/.ssh/authorized_keys or /etc/cron.d/ml-backdoor. When a data scientist or an automated CI/CD pipeline calls download_model_with_test_data on this model URL — a common step in model benchmarking or testing workflows — the extraction routine writes the attacker's content to the specified absolute path without validation. The attacker now holds persistent SSH access to the ML training server or model serving host, enabling exfiltration of proprietary weights, training data, API keys in environment files, and lateral movement into the broader cloud environment.