vellaveto/onnx-scanner-bypass-poc

ONNX Scanner Bypass PoC — Security Research Artifacts

WARNING: These are intentionally malformed/malicious model files for authorized security research. DO NOT load them outside sandboxed environments.

Purpose

External data path traversal, SSRF via external data URL, and injection in doc_string bypass modelscan 0.8.8 (4/4 malicious MISSED).

Responsible disclosure artifacts for the huntr MFV program.

Scanner Results (2026-03-20)

modelscan 0.8.8: ALL payloads MISSED.

File	Technique	modelscan	Impact
onnx_external_traversal.onnx	../../../etc/passwd in external_data location field	MISSED	Arbitrary file read when model loads external data
onnx_external_ssrf.onnx	http://169.254.169.254/ as external_data location	MISSED	SSRF to cloud metadata on model load
onnx_docstring_inject.onnx	Python code + XSS in model doc_string field	MISSED	Code execution if doc_string is evaluated or rendered
onnx_tensor_name_traversal.onnx	Path traversal in initializer tensor name	MISSED	File write if tensor name used as path
onnx_baseline.onnx	Clean baseline model (control)	MISSED	No malicious content

Format

ONNX ($4,000 MFV bounty on huntr)

Researcher

vellaveto