Information Exposure Vulnerability in Tract ONNX Inference Toolkit
CVE-2026-55832
6.1MEDIUM
What is CVE-2026-55832?
The Tract inference toolkit allows for the loading of untrusted ONNX models, exposing a risk where attacker-controlled references can lead to the opening of arbitrary local files. This can place sensitive contents into model tensors or inference outputs, raising significant security concerns for applications utilizing this toolkit. Prior versions (0.21.16, 0.22.2, and 0.23.1) are particularly at risk during the model loading process, which lacks proper validation checks for absolute paths or parent directory components. Users are advised to upgrade to the patched versions to mitigate this vulnerability.
Affected Version(s)
tract < 0.21.17 < 0.21.17
tract >= 0.22.0, < 0.22.3 < 0.22.0, 0.22.3
tract >= 0.23.0, < 0.23.2 < 0.23.0, 0.23.2