CVE-2026-28500 is a high severity (CVSS 8.6) weakness in ONNX through version 1.20.1. Passing silent=True to onnx.hub.load() suppresses every trust warning and prompt, so a model can come from an unverified repository without anyone noticing. The advisory lists 1.21.0rc1, where the feature was removed.
What's affected
The GitHub advisory lists the PyPI package onnx at 1.20.1 and earlier. Its first patched version is listed as 1.21.0rc1, and the resolution is described as removing the feature.
The NVD text says that at publication no patched versions were available, so check the project's release notes before you rely on a specific release.
You are only exposed if your code calls onnx.hub.load() with a repository other than the official one, and with silent=True.
How to check if you're exposed
Check the installed version:
pip show onnx
Then search your own code and notebooks for the risky call pattern:
grep -rn "hub.load" --include=*.py --include=*.ipynb .
Any call that passes an external repository string with silent=True deserves a closer look.
What to do now
- Find every use of
onnx.hub.load()in code, notebooks and pipelines. - Remove
silent=True, and stop loading models from repositories you have not reviewed. - Pin models to reviewed sources and verify them yourself, for example by mirroring approved models into storage you control.
- Upgrade
onnxto a release that removes the feature, confirming the version in the advisory and release notes.
Why it matters
The record lists several related weakness classes, including CWE-345 (insufficient verification of data authenticity), CWE-494 (download of code without an integrity check), CWE-693 (protection mechanism failure) and CWE-829 (inclusion of functionality from an untrusted control sphere).
The advisory adds a second point: the SHA256 check in this path validates against a manifest that lives in the same repository, so an attacker who controls the repository controls the manifest too. The integrity check gives no protection against a malicious repo.
The description says the danger rises if a model can execute code on load. This is a supply chain issue in how models are fetched, which matters for ML pipelines that run unattended. The record does not mark it as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a call without silent=True safe?
The warning and prompt are the protection the function offers, so a call that shows them is better. Still, the advisory notes the hash check cannot defend against a repository the attacker controls, so avoid untrusted repositories altogether.
Sources
Last reviewed: 19 October 2026.
