Read the docs
TI-2026-40299 Aliases CVE-2026-55832GHSA-h668-6x6g-f8r5

Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed tract (sonos): 0.21.17, 0.22.3, 0.23.2tract-onnx (crates.io): 0.21.17, 0.22.3, 0.23.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Sonostractbefore 0.21.17; 0.22.0 to before 0.22.3; 0.23.0 to before 0.23.20.21.17, 0.22.3, 0.23.2Patch availableCNA
—tract-onnx (crates.io)before 0.21.170.21.17Patch availableGHSA-h668-6x6g-f8r5
—tract-onnx (crates.io)0.22.0 to before 0.22.30.22.3Patch availableGHSA-h668-6x6g-f8r5
—tract-onnx (crates.io)0.23.0 to before 0.23.20.23.2Patch availableGHSA-h668-6x6g-f8r5
  • tract VendorSonos Affected before 0.21.17; 0.22.0 to before 0.22.3; 0.23.0 to before 0.23.2 Fixed in 0.21.17, 0.22.3, 0.23.2 Patch available CNA
  • tract-onnx (crates.io) Vendor— Affected before 0.21.17 Fixed in 0.21.17 Patch available GHSA-h668-6x6g-f8r5
  • tract-onnx (crates.io) Vendor— Affected 0.22.0 to before 0.22.3 Fixed in 0.22.3 Patch available GHSA-h668-6x6g-f8r5
  • tract-onnx (crates.io) Vendor— Affected 0.23.0 to before 0.23.2 Fixed in 0.23.2 Patch available GHSA-h668-6x6g-f8r5

Remediation

  • Fix · CNA tract (sonos) Fixed in 0.21.17, 0.22.3, 0.23.2
  • Fix · GHSA-h668-6x6g-f8r5 tract-onnx (crates.io) Fixed in 0.21.17 Advisory →
  • Fix · GHSA-h668-6x6g-f8r5 tract-onnx (crates.io) Fixed in 0.22.3 Advisory →
  • Fix · GHSA-h668-6x6g-f8r5 tract-onnx (crates.io) Fixed in 0.23.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55832
  2. 2026-10-03 Alias added: GHSA-h668-6x6g-f8r5

References

Other 8

  • TI-2020-07425 Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access… CVSS 3.1MEDIUM 6.8
  • TI-2026-39797 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load CVSS 3.1MEDIUM 6.1
  • TI-2026-52761 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size CVSS 4.0MEDIUM 5.3
  • TI-2022-08009 Stack-based buffer overflow in Sonos One Speaker CVSS 3.1CRITICAL 9.8
  • TI-2026-03597 Memory corruption in Sonos Era 300 CVSS 3.1CRITICAL 9.8
  • TI-2025-28483 Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used… CVSS 3.1LOW 3.4
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences