{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "0.21.17"
              },
              {
                "introduced": "0.22.0"
              },
              {
                "fixed": "0.22.3"
              },
              {
                "introduced": "0.23.0"
              },
              {
                "fixed": "0.23.2"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "2f8f99bc6c22ec44eba810eea49ca9602255408f"
            },
            {
              "introduced": "bf90b4b9ef4099a25217ec0aef3d5b9aa0497e38"
            },
            {
              "fixed": "b0c1bc8e8073bfa29b53460ac4210869863b84e3"
            },
            {
              "fixed": "1541d4037cd9960107385079f1732968daacafd5"
            },
            {
              "fixed": "d80f31682f47a92e8f5f90512201f26c9d9bdc7a"
            },
            {
              "fixed": "5f994bcf3cec9b343830a975fedce177f9190d0f"
            },
            {
              "fixed": "85f4fac23e43d417782e8ed9f9465be8474f5c98"
            },
            {
              "fixed": "8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"
            }
          ],
          "repo": "https://github.com/sonos/tract",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-h668-6x6g-f8r5"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55832.json"
  },
  "details": "Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.",
  "id": "CVE-2026-55832",
  "modified": "2026-09-16T03:30:14.363452493Z",
  "published": "2026-09-14T17:57:41.374Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sonos/tract/releases/tag/0.21.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonos/tract/releases/tag/0.22.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sonos/tract/releases/tag/v0.23.2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55832.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55832"
    },
    {
      "type": "FIX",
      "url": "https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f"
    },
    {
      "type": "FIX",
      "url": "https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98"
    },
    {
      "type": "FIX",
      "url": "https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx"
}