MEDIUM5.0

PYSEC-2026-3747

Quick fix

PYSEC-2026-3747 — netron: upgrade to the fixed version with the command below.

pip install --upgrade 'netron>=9.1.3'

Details

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/netron

Introduced in: 0Fixed in: 9.1.3

Fixpip install --upgrade 'netron>=9.1.3'

References

https://github.com/lutzroeder/netron/commit/cd14bad8c9132b1aaf1d197fe61925575f194f00[FIX]
https://www.hiddenlayer.com/sai-security-advisory/2026-08-netron[EVIDENCE]