Answer in brief
CVE-2026-55832 records a Medium severity vulnerability in Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx. The current sources do not mark it as known exploited. The current feed maps sonos/tract (generic), tract-onnx (rust), tract-onnx (rust), tract-onnx (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps sonos/tract (generic), tract-onnx (rust), tract-onnx (rust), tract-onnx (rust). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sonos/tractgeneric | < 0.21.17 || >= 0.22.0, < 0.22.3 || >= 0.23.0, < 0.23.2 | Not reported |
| tract-onnxrust | >=0.22.0,<0.22.3 | 0.22.3 |
| tract-onnxrust | >=0.23.0,<0.23.2 | 0.23.2 |
| tract-onnxrust | <0.21.17 | 0.21.17 |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.
Quoted source text, attributed separately from HOL analysis.