diff --git a/tools/ci_build/requirements.txt b/tools/ci_build/requirements.txt
index 3734d64a5dd1a..e56c3e7b7dae5 100644
--- a/tools/ci_build/requirements.txt
+++ b/tools/ci_build/requirements.txt
@@ -5,3 +5,4 @@ coloredlogs==15.0
 transformers==4.6.1
 onnxconverter-common==1.8.1
 psutil
+onnx>=1.21.0 # not directly required, pinned by Snyk to avoid a vulnerability