tract: ONNX external_data path is not sanitised, so loading a model reads arbitrary local files

CVSS 6.1CVE-2026-55832AI/ML frameworks & servingcurated

Impact

get_external_resources joins the attacker-controlled external_data location to the model directory without rejecting absolute paths or .. components, so MmapDataResolver will mmap any file the serving process can read and place its contents into model tensors or inference output. A tenant that can submit an ONNX model to an inference service therefore gets a file-read primitive with the privileges of the model server - service account tokens, API keys, other tenants' model weights on shared storage - and the data comes back through ordinary inference results, which makes it unlikely to look like an attack in logs. Attacker-controlled offset and length can also select an out-of-range mapping and crash the process. The flaw does not write files or execute code. This is a distinct path-traversal issue from the NNEF over-read in CVE-2026-55093 and has its own fixed versions.

Who can reach it

Anyone who can supply a model file that the process loads via model_for_path - typically a tenant uploading an ONNX model, or a pipeline pulling a model from an untrusted registry.

What to do

Upgrade tract to 0.21.17, 0.22.3 or 0.23.2, rebuild anything vendoring tract-onnx, and restart the serving process. As mitigation, reject ONNX models that declare external_data, or load untrusted models in a sandbox with no access to secrets and no other tenants' data on the filesystem.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55832 https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f https://github.com/sonos/tract/releases/tag/0.21.17 https://github.com/sonos/tract/releases/tag/0.22.3

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.