---
id: CVE-2026-55832
title: >-
  Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference
  toolkit
summary: >-
  Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference
  toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the
  attacker-controlled external_data location from an ONNX model through
  onnx/src/tens…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L'
cwe:
  - CWE-22
vendor: sonos
product: tract
affected:
  - tract < 0.21.17
  - 'tract >= 0.22.0, < 0.22.3'
  - 'tract >= 0.23.0, < 0.23.2'
patched:
  - tract-onnx 0.21.17
  - tract-onnx 0.22.3
  - tract-onnx 0.23.2
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:32.717'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55832'
references:
  - url: >-
      https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f
    label: security-advisories@github.com
  - url: >-
      https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98
    label: security-advisories@github.com
  - url: >-
      https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632
    label: security-advisories@github.com
  - url: 'https://github.com/sonos/tract/releases/tag/0.21.17'
    label: security-advisories@github.com
  - url: 'https://github.com/sonos/tract/releases/tag/0.22.3'
    label: security-advisories@github.com
  - url: 'https://github.com/sonos/tract/releases/tag/v0.23.2'
    label: security-advisories@github.com
  - url: 'https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5'
    label: security-advisories@github.com
  - url: 'https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-h668-6x6g-f8r5'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - rust
ecosystem: rust
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T18:12:49.766808Z'
ingestedAt: '2026-06-22T15:59:08.182Z'
epss: 0.00236
epssPercentile: 0.14864
---

## Overview

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55832)

Affected packages:

- `tract-onnx < 0.21.17`
- `tract-onnx >= 0.22.0, < 0.22.3`
- `tract-onnx >= 0.23.0, < 0.23.2`

Patched in:

- `tract-onnx 0.21.17`
- `tract-onnx 0.22.3`
- `tract-onnx 0.23.2`

Source: https://github.com/advisories/GHSA-h668-6x6g-f8r5