{"id":"CVE-2026-55832","title":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit","summary":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tens…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","cwe":["CWE-22"],"vendor":"sonos","product":"tract","affected":["tract < 0.21.17","tract >= 0.22.0, < 0.22.3","tract >= 0.23.0, < 0.23.2"],"patched":["tract-onnx 0.21.17","tract-onnx 0.22.3","tract-onnx 0.23.2"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T19:17:32.717","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55832","references":[{"url":"https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/releases/tag/0.21.17","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/releases/tag/0.22.3","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/releases/tag/v0.23.2","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5","label":"security-advisories@github.com"},{"url":"https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-h668-6x6g-f8r5"}],"tags":["nvd","cve.org","exploit-available","ghsa","rust"],"ecosystem":"rust","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T18:12:49.766808Z"},"ingestedAt":"2026-06-22T15:59:08.182Z","epss":0.00236,"epssPercentile":0.14845,"slug":"CVE-2026-55832","body":"## Overview\n\nTract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55832)\n\nAffected packages:\n\n- `tract-onnx < 0.21.17`\n- `tract-onnx >= 0.22.0, < 0.22.3`\n- `tract-onnx >= 0.23.0, < 0.23.2`\n\nPatched in:\n\n- `tract-onnx 0.21.17`\n- `tract-onnx 0.22.3`\n- `tract-onnx 0.23.2`\n\nSource: https://github.com/advisories/GHSA-h668-6x6g-f8r5","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":203155,"id":"CVE-2026-55832","ts":1789413238377,"field":"exploit_available","old":"false","new":"true"}]}