CVE-2024-7776 is a critical (CVSS 9.1) path traversal in the download_model function of the onnx package, in versions up to and including 1.16.1. A malicious tar file can write outside the intended folder and overwrite files. Upgrade past 1.16.1 and avoid downloading models from untrusted sources.
What's affected
The record covers the onnx/onnx framework, before and including version 1.16.1. The vulnerable code is the download_model function, which fetches a model archive and extracts it.
The weakness is that file names inside the tar archive are not checked well enough, so an archive can include entries that point outside the destination directory. The record says this lets an attacker overwrite files in the user's directory, which could lead to remote command execution.
The record gives no first fixed version. The reference is a huntr bounty page that we could not load automatically. Because the affected range ends at 1.16.1, a newer release is the right target, but check the ONNX release notes for the first version that names this fix.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show onnx
pip list | grep -i onnx
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for onnx and read the pinned version.
Then search your code and notebooks for calls to onnx.hub or to a function named download_model. If nothing calls it, the vulnerable path is not used, although you should still upgrade.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- Find every environment with onnx at 1.16.1 or lower.
- Upgrade to a newer onnx release and confirm the release notes mention the fix.
- Search code for download_model and onnx hub usage.
- Only fetch model archives from sources you control, and verify checksums.
- Run model download and extraction steps in a container or a throwaway directory with limited write access.
Why it matters
Extracting an archive is a classic place for path traversal. Each entry in a tar file carries a name, and a name can contain parent directory markers. If the extractor joins that name to the target folder without checking where it ends up, the file lands somewhere else.
The class is path traversal, and the impact here is overwriting files, which can become code execution if the file is a script, a startup file or a shell profile. Safe extraction resolves the final path and refuses anything outside the target folder. Many ecosystems have added such filters to their own archive libraries over the last few years.
The weakness class is CWE-22: Path Traversal. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which scores 9.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to call download_model to be at risk?
The record describes the flaw in that function. If your code never calls it, the vulnerable path is not used, but upgrading is still sensible.
Is the exact fixed version confirmed here?
No. The affected range ends at 1.16.1, so move to a newer release and check its notes.
Sources
Last reviewed: 19 October 2026.
