GitHub Repos· Oct 28, 2026· by s1ko

s1ko/onnx-einsum-ellipsis-oob

Open Original Article ↗
onnx Einsum shape inference: out-of-bounds read when ellipsis operands differ in rank (SIGSEGV via infer_shapes / check_model). Fixed in onnx 1.23.0.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.
#cwe-125#einsum#fixed#onnx#security#shape-inference#vulnerability-research