AIKIDO-2026-10181

TL;DR

Affected versions of this package allow external data references in TensorProto to point to arbitrary file locations without enforcing that the data resides under the model directory, enabling unsafe path resolution. An attacker could craft a malicious model containing absolute paths or path traversal sequences (e.g., ../) to force the system to load unintended files from the host filesystem. This may result in unauthorized file access, sensitive data disclosure, or unintended behavior depending on the execution environment. Exploitation typically requires supplying a specially crafted model that bypasses directory validation during external data loading.