ONNX implicit-CWD external-data read PoC

• a malicious ONNX model stored only as raw bytes can carry a Constant tensor whose data is marked as external
• onnx.numpy_helper.to_array() will auto-load that external tensor even when no trusted base directory was provided
• onnx.reference.ReferenceEvaluator(model_bytes) reaches the same sink automatically and returns the local file bytes as model output

• arbitrary path traversal outside the current working directory
• code execution

Files

• repro.py: creates a temporary working directory, places a local secret file there, builds a malicious ONNX model, and demonstrates both public exploit paths

Verified Runtime

• onnx 1.22.0

Example