https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:20:18 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-55832 <p>Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.</p> <p>Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-55832 https://db.gcve.eu/vuln/ghsa-h668-6x6g-f8r5 <p><strong>Affected:</strong> crates.io: tract-onnx</p> <p>### Summary</p> <p>`tract` (the `tract-onnx` crate) resolves an ONNX tensor&#39;s external-data `location` by joining it onto the model directory **without any sanitization**. Because `location` comes from the (untrusted) `.onnx` file, a malicious model can make `tract` open and read an **arbitrary local file** at load time, with the file&#39;s contents flowing into the model&#39;s tensors / inference output (read-only file disclosure). This is the ONNX external-data path-traversal class that the reference `onnx` library hardened over several CVEs; `tract` resolves `location` itself and was never hardened.</p> <p>### Details</p> <p>In `onnx/src/tensor.rs`, `get_external_resources()` builds the path with no checks:</p> <p>```rust let location = /* tensor.external_data &#34;location&#34; value — attacker-controlled */; let p = PathBuf::from(path).join(location); // no is_absolute / &#34;..&#34; / canonicalize / containment check provider.read_bytes_from_path(&amp;mut tensor_data, &amp;p, offset, length)?; // Mmap::map(File::open(p)) by default ```</p> <p>- `Path::join` with an **absolute** `location` (e.g. `/etc/passwd`) discards the base directory → `p = /etc/passwd`. - A **relative** `../../../../etc/passwd` value is not normalized → directory traversal. - The default `MmapDataResolver` (`onnx/src/data_resolver.rs`) then `mmap`s the file and copies `mmap[offset..offset+length]` into the tensor. `offset`/`length` are also taken from the file; an out-of-range slice **panics** (DoS).</p> <p>No `is_absolute`, `..`, `canonicalize`, or cont…</p> <p><strong>Affected:</strong> crates.io: tract-onnx</p> <p>### Summary</p> <p>`tract` (the `tract-onnx` crate) resolves an ONNX tensor&#39;s external-data `location` by joining it onto the model directory **without any sanitization**. Because `location` comes from the (untrusted) `.onnx` file, a malicious model can make `tract` open and read an **arbitrary local file** at load time, with the file&#39;s contents flowing into the model&#39;s tensors / inference output (read-only file disclosure). This is the ONNX external-data path-traversal class that the reference `onnx` library hardened over several CVEs; `tract` resolves `location` itself and was never hardened.</p> <p>### Details</p> <p>In `onnx/src/tensor.rs`, `get_external_resources()` builds the path with no checks:</p> <p>```rust let location = /* tensor.external_data &#34;location&#34; value — attacker-controlled */; let p = PathBuf::from(path).join(location); // no is_absolute / &#34;..&#34; / canonicalize / containment check provider.read_bytes_from_path(&amp;mut tensor_data, &amp;p, offset, length)?; // Mmap::map(File::open(p)) by default ```</p> <p>- `Path::join` with an **absolute** `location` (e.g. `/etc/passwd`) discards the base directory → `p = /etc/passwd`. - A **relative** `../../../../etc/passwd` value is not normalized → directory traversal. - The default `MmapDataResolver` (`onnx/src/data_resolver.rs`) then `mmap`s the file and copies `mmap[offset..offset+length]` into the tensor. `offset`/`length` are also taken from the file; an out-of-range slice **panics** (DoS).</p> <p>No `is_absolute`, `..`, `canonicalize`, or cont…</p> https://db.gcve.eu/vuln/ghsa-h668-6x6g-f8r5