vellaveto/onnx-scanner-bypass-poc

By vellaveto · ↓ 0 · ♥ 0 · Updated 2026-03-20

What's in this repo

This page lists the files in vellaveto/onnx-scanner-bypass-poc, including onnx_baseline.onnx, onnx_docstring_inject.onnx, onnx_external_ssrf.onnx and more.

5 ONNX models (.onnx files)
7 files, including 5 .onnx, 1 .md
Last updated 2026-03-20

ONNX files

File	Size	Download
onnx_baseline.onnx	—	Download
onnx_docstring_inject.onnx	—	Download
onnx_external_ssrf.onnx	—	Download
onnx_external_traversal.onnx	—	Download
onnx_tensor_name_traversal.onnx	—	Download

How to use

These ONNX files can be loaded with ONNX Runtime. To inspect a model graph, upload the file to the Netron viewer. Download links point to the original files on Hugging Face.

README

ONNX Scanner Bypass PoC — Security Research Artifacts

WARNING: These are intentionally malformed/malicious model files for authorized security research. DO NOT load them outside sandboxed environments.

Purpose

External data path traversal, SSRF via external data URL, and injection in doc_string bypass modelscan 0.8.8 (4/4 malicious MISSED).

Responsible disclosure artifacts for the huntr MFV program.

Scanner Results (2026-03-20)

modelscan 0.8.8: ALL payloads MISSED.

File	Technique	modelscan	Impact
`onnx_external_traversal.onnx`	`../../../etc/passwd` in external_data location field	MISSED	Arbitrary file read when model loads external data
`onnx_external_ssrf.onnx`	`http://169.254.169.254/` as external_data location	MISSED	SSRF to cloud metadata on model load
`onnx_docstring_inject.onnx`	Python code + XSS in model doc_string field	MISSED	Code execution if doc_string is evaluated or rendered
`onnx_tensor_name_traversal.onnx`	Path traversal in initializer tensor name	MISSED	File write if tensor name used as path
`onnx_baseline.onnx`	Clean baseline model (control)	MISSED	No malicious content

Format

ONNX ($4,000 MFV bounty on huntr)

Researcher

vellaveto

Model info

onnx security-research vulnerability-disclosure model-file-vulnerability license:mit region:us

↓ 0 ♥ 0

Created: 2026-03-20

Updated: 2026-03-20

View on Hugging Face

Files (7)

.gitattributes

README.md

onnx_baseline.onnx ONNX

onnx_docstring_inject.onnx ONNX

onnx_external_ssrf.onnx ONNX

onnx_external_traversal.onnx ONNX

onnx_tensor_name_traversal.onnx ONNX

Related models

More models

No task type declared.