onnx-numpy-helper-cwd-read-poc

ONNX implicit-CWD external-data read PoC

This PoC is intentionally narrow and matches the verified behavior on built onnx 1.22.0.

What it shows:

• a malicious ONNX model stored only as raw bytes can carry a Constant tensor whose data is marked as external
• onnx.numpy_helper.to_array() will auto-load that external tensor even when no trusted base directory was provided
• onnx.reference.ReferenceEvaluator(model_bytes) reaches the same sink automatically and returns the local file bytes as model output

What it does not show:

• arbitrary path traversal outside the current working directory
• code execution

Files

• repro.py: creates a temporary working directory, places a local secret file there, builds a malicious ONNX model, and demonstrates both public exploit paths

Verified Runtime

• onnx 1.22.0

Example

PYTHONPATH=/mnt/data/huntr/.pydeps-onnx \
/home/thun/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 \
repro.py