Medium, CVSS 6.1crates.ioPublished
tract: Arbitrary file read via unsanitized ONNX external_data location (path traversal) on model load in tract-onnx
CVE-2026-55832 · GHSA-h668-6x6g-f8r5
- Affected
- crates.io tract-onnx < 0.21.17; >= 0.22.0, < 0.22.3; >= 0.23.0, < 0.23.2
- Fixed in
- 0.22.30.21.170.23.2· Vendor fix available
- Issue
- tract (the tract-onnx crate) resolves an ONNX tensor's external-data location by joining it onto the model directory without any sanitization. Because location comes from the (untrusted) .onnx file, a malicious model can make tract open and read an arbitrary local file at load time, with the file's contents flowing into the model's tensors / inference output (read-only file disclosure). This is the ONNX external-data path-traversal class that the reference onnx library hardened over several CVEs; tract resolves location itself and was never hardened. Details In onnx/src/tensor.rs, getexternalresources() builds the path with no checks: - Path::join with an absolute location (e.g. /etc/passwd) discards the base directory → p = /etc/passwd. - A relative ../../../../etc/passwd value is not normalized → directory traversal. - The default MmapDataResolver (onnx/src/dataresolver.rs) then mmaps the file and copies mmap[offset..offset+length] into the tensor. offset/length are also…
Recommended action: Upgrade to 0.23.2, 0.22.3 or 0.21.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.