CVE-2026-55832
1 advisory.
crates.io/tract-onnx CVE-2026-55832: medium 6.1, EPSS 0.19%
tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
Action: Upgrade tract-onnx to 0.21.17 or later.
cargo update -p tract-onnx --precise 0.21.17cargo update -p tract-onnx --precise 0.22.3cargo update -p tract-onnx --precise 0.23.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.21.17 | - |
| 0.22.0 | 0.22.3 | - |
| 0.23.0 | 0.23.2 | - |
Fixed versions
| 0.21.17 | 0.22.3 | 0.23.2 |
Sources
- osv: GHSA-h668-6x6g-f8r5
- https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5
- https://github.com/sonos/tract
CVE-2026-55832 · published · modified · JSON