You can deploy this model and start earning money today!

vellaveto/
onnx-scanner-bypass-poc

Name: onnx-scanner-bypass-poc
Availability: InStock

onnx

security-research

vulnerability-disclosure

model-file-vulnerability

mit

Views

No views yet

ONNX Scanner Bypass PoC — Security Research Artifacts

WARNING: These are intentionally malformed/malicious model files for authorized security research. DO NOT load them outside sandboxed environments.

Purpose

External data path traversal, SSRF via external data URL, and injection in doc_string bypass modelscan 0.8.8 (4/4 malicious MISSED).

Responsible disclosure artifacts for the huntr MFV program.

Scanner Results (2026-03-20)

modelscan 0.8.8: ALL payloads MISSED.

File	Technique	modelscan	Impact
`onnx_external_traversal.onnx`	`../../../etc/passwd` in external_data location field	MISSED	Arbitrary file read when model loads external data
`onnx_external_ssrf.onnx`	`http://169.254.169.254/` as external_data location	MISSED	SSRF to cloud metadata on model load
`onnx_docstring_inject.onnx`	Python code + XSS in model doc_string field	MISSED	Code execution if doc_string is evaluated or rendered
`onnx_tensor_name_traversal.onnx`	Path traversal in initializer tensor name	MISSED	File write if tensor name used as path
`onnx_baseline.onnx`	Clean baseline model (control)	MISSED	No malicious content

Format

ONNX ($4,000 MFV bounty on huntr)

Researcher

vellaveto

vellaveto/onnx-scanner-bypass-poc