1-click DOM XSS via Unsanitized innerHTML

‍

CVE Number

CVE-2026-79718

CVE-2026-79719

CVE-2026-79720

‍

Summary

Netron renders user-controlled model fields without HTML escaping. An attacker can craft a malicious model file (any format supported by Netron) that injects arbitrary HTML into the Netron sidebar. In the desktop application, this allows an attacker to make unrestricted HTTP requests to local network services. Furthermore, as the desktop app ships a pinned Chromium version (Electron 42.3.3 / Chrome 148), known n-day V8 vulnerabilities in that renderer could be chained with this primitive to achieve full RCE on the system.

‍

Products Impacted

All Netron releases are affected up to version 9.1.2 included.

A patch is implemented and available starting version 9.1.3 (commit)

‍

CVSS Score: 6.8

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

‍

CWE Categorization

CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

‍

Details

Netron uses the escape() helper correctly throughout the file. There are, however, three places where user-controlled model fields are written directly into innerHTML:

The node’s name

const name = this._node.name;
const element = this.createElement('div', 'sidebar-item-value-line-border');
element.innerHTML = `<span class='sidebar-item-value-line-content'>name: <b>${name}</b></span>`;

The input value description

const description = this._argument.description;
if (description) {
    const line = this.createElement('div', 'sidebar-item-value-line-border');
    line.innerHTML = description;

The output value description

const description = this._value.description;
if (description) {
    const line = this.createElement('div', 'sidebar-item-value-line-border');
    line.innerHTML = description;

All three fire when the user clicks a node to open the sidebar. Setting any of these fields to an HTML string in a crafted ONNX file causes the browser to parse and render it.

Netron has a Content-Security-Policy (CSP) as an additional safety measure. It is set to script-src 'self'. This blocks inline <script> tags and external scripts, but there is no frame-src directive. An <iframe> pointing at a cross-origin URL is permitted. The framed page is of a different origin, so it does not inherit the parent CSP, and as such, scripts inside it execute freely.

Inside of Netron, simply selecting the Identity node will trigger the XSS:

When the node is selected, pop up like this will appear:

The impact of executing arbitrary JavaScript in this context can seem relatively low because Netron has no cookies, no accounts, or anything to steal. However, there are three clear impacts:

• An attacker can hide certain nodes from the UI, effectively hiding a backdoor
• An attacker can perform port scanning
• An attacker can abuse V8 renderer n-days targeting the release (Chrome 148.0.7778.218) that could be chained with this XSS to escape the renderer sandbox and achieve full RCE on the host

‍

Project URL:

https://netron.app/ 

https://github.com/lutzroeder/netron.git

‍

RESEARCHER: Esteban Tonglet, Security Researcher, HiddenLayer