Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit

Overview

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-55832)

Affected packages:

• tract-onnx < 0.21.17
• tract-onnx >= 0.22.0, < 0.22.3
• tract-onnx >= 0.23.0, < 0.23.2

Patched in:

• tract-onnx 0.21.17
• tract-onnx 0.22.3
• tract-onnx 0.23.2

Source: https://github.com/advisories/GHSA-h668-6x6g-f8r5