CVE-2026-79718: Netron Reflected XSS Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-79718: Reflected XSS in Netron versions. Affects netron versions < 9.1.3. Fixed in 9.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netron is a popular open-source desktop application used for visualizing deep learning models. It supports a variety of model formats and provides an intuitive interface for users to analyze and understand their models. However, versions up to 9.1.2 are vulnerable to a reflected cross-site scripting (XSS) attack due to unsanitized node names, which can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the handling of node names within the Netron application. Attackers can exploit this flaw by injecting malicious scripts through unsanitized input, leading to reflected XSS. This can allow them to hide certain nodes, perform port scanning, or leverage a Chrome n-day vulnerability to execute arbitrary code remotely. The implications of this vulnerability are severe, as it can lead to unauthorized access and manipulation of the user's environment.
How To Fix
Minimum fixed version
9.1.3
This is the first release that contains the fix.
pip install --upgrade "netron==9.1.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using node names that may contain special characters or scripts until they can update to the patched version. Additionally, limiting the application's access to untrusted networks can help mitigate the risk.
Conclusion
The reflected XSS vulnerability in Netron versions up to 9.1.2 poses a significant risk to users, allowing for potential remote code execution. It is crucial to update to version 9.1.3 or later to mitigate this risk. Users are also encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for netron →
FAQ
The CVSS score for this vulnerability is 5.0, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, unauthorized access, and manipulation of the user's environment.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
If you cannot update immediately, consider implementing temporary workarounds such as avoiding risky node names and limiting network access.
References
Related vulnerabilities
Recent vulnerabilities recorded for netron.
