CVE-2026-55832 in tract
Summary
by MITRE • 09/14/2026
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in the Tract inference toolkit affects versions prior to 0.21.17, 0.22.3, and 0.23.2 within the tract-onnx crate. This security flaw stems from an improper handling of external data references embedded within Open Neural Network Exchange format models. When a user loads an untrusted ONNX model using the model_for_path function, the system processes tensor definitions that may include pointers to external files containing large amounts of binary data. The core issue lies in how the get_external_resources method constructs file paths from these attacker-controlled inputs without performing adequate validation on path components or absolute path indicators.
Specifically, the code joins the value provided for an external_data location directly with the model directory using standard string concatenation logic that fails to sanitize input. This allows an adversary to supply a path containing parent directory traversal sequences such as dot-dot-slash or specify an absolute file system path. Consequently, when the MmapDataResolver component attempts to map these files into memory for inference processing, it does not restrict access to the model's local directory structure. Instead, it opens and maps arbitrary local files from the host operating system based on the crafted input values found within the malicious ONNX model definition.
The operational impact of this vulnerability is primarily focused on unauthorized data exposure rather than remote code execution or file modification. By leveraging absolute paths or traversal sequences, an attacker can cause the inference engine to read sensitive information stored elsewhere on the disk and inject those contents into model tensors or inference outputs. This effectively turns the machine learning workload into a mechanism for arbitrary local file reading. While the vulnerability does not allow writing files or executing code directly through this specific flaw, it poses a significant risk of confidentiality breach in environments where Tract is used to process models from untrusted sources, such as public model repositories or user-uploaded datasets.
Additionally, the attacker can manipulate offset and length fields associated with external data mappings. By specifying values that exceed the bounds of the mapped file region, an adversary can trigger out-of-range memory access errors within the MmapDataResolver logic. This capability enables a denial of service condition by causing crashes or halting inference operations when invalid ranges are processed. Although this aspect does not lead to privilege escalation or code execution, it undermines the availability and reliability of services relying on Tract for model inference tasks.
To mitigate these risks, organizations must upgrade immediately to version 0.21.17, 0.22.3, or 0.23.2 where this issue has been resolved through improved path validation logic that rejects absolute paths and parent directory components. In the interim, if upgrading is not feasible, it is critical to enforce strict input sanitization at the application layer before passing any ONNX models to Tract. This includes validating all external_data references against a whitelist of allowed directories or ensuring they are relative paths confined within expected boundaries. Implementing these controls aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and mitigates risks associated with ATT&CK technique T1083 File and Directory Discovery by preventing the inference engine from being used as an arbitrary file read primitive.