Cross-file Model Reference Vulnerability in esmf-sdk-py-aspect-model-loader by Eclipse

CVE-2026-92610

What is CVE-2026-92610?

The esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1 allows for the exploitation of cross-file model references. By extracting components of the urn:samm namespace from parsed Turtle files, the loader can inadvertently access and merge contents from arbitrary directories outside the intended model's root. This occurs when model files are crafted with specific prefix declarations, leading to potential exposure of sensitive data or manipulation of the model graphs.

References