tensorrt-onnx-external-data-symlink-poc-20260528

TensorRT ONNX external_data symlink PoC

This repository contains a minimal safe proof of concept for a TensorRT ONNX parser issue in tensorrt-cu12==10.16.0.72.

The ONNX model uses external_data for initializer W with location=weights.bin. Inside the model directory, weights.bin is a symlink to a controlled marker file outside the model directory. TensorRT follows the symlink, maps the target file, imports the bytes as tensor weights, builds a serialized engine, and the marker bytes appear inside the engine.

The PoC intentionally uses a controlled marker file (LH870_TRT_SECRET!) instead of reading real system secrets.

Files

• poc.zip - Minimal PoC package and 3x reproduction log.
• sha256.txt - SHA256 checksum for poc.zip.
• make_external_data_pocs.py - Generates the ONNX external_data fixtures.
• parse_with_tensorrt.py - Parses/builds the ONNX model with TensorRT.
• h1_outside_model_dir_build_marker_3x.log - Evidence showing 3/3 successful reproductions.

Expected result

TensorRT should reject symlink external data files or verify that the opened file is a regular file within the model package boundary after filesystem resolution.

Observed result

TensorRT reads and maps weights.bin, follows the symlink to a file outside the model directory, and embeds the controlled marker bytes into the serialized engine.