Hi,

The following vulnerabilities were published for onnx.

CVE-2026-49114[0]:
| In ONNX before 1.21.0, the 'save_external_data' function builds the
| external-data file path from the model's external_data location
| field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a
| non-atomic 'os.path.isfile()' check. A local attacker with write
| access to the directory where a victim serializes external data can
| deterministically pre-plant a symlink that is being followed,
| causing the victim's write to append to any file the victim can
| write, e.g. ~/.ssh/authorized_keys, cron files, or application
| configs. Fixed in 1.21.0.


CVE-2026-63632[1]:
| Open Neural Network Exchange (ONNX) is an open standard for machine
| learning interoperability. From 1.3.0 until 1.22.0,
| onnx.version_converter.convert_version() can perform an out-of-
| bounds read in Gemm_7_6::adapt_gemm_7_6() in
| onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has
| input tensors with fewer than two dimensions because B_shape[1],
| A_shape[0], or A_shape[1] is accessed without a rank check,
| potentially causing a process crash during an opset 7 to 6
| downgrade. This issue is fixed in version 1.22.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-49114
https://www.cve.org/CVERecord?id=CVE-2026-49114
[1] https://security-tracker.debian.org/tracker/CVE-2026-63632
https://www.cve.org/CVERecord?id=CVE-2026-63632

Regards,
Salvatore