CVE-2026-79718
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.
Risk Assessment
An attacker could gain remote access to the user's system, potentially leading to data theft or full machine compromise.
Recommendation
Update Netron to a version newer than 9.1.2 or avoid opening untrusted model files.
Other vulnerabilities in Netron
See all- CVE-2026-79720Medium
Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.
- CVE-2026-79719Medium
Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.
Original NVD description (English source)
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS