Description

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T18:17:55.663Z",
  "pubdate": "2026-09-14T18:17:55.663Z",
  "executiveSummary": "The tract-onnx crate contains a directory traversal and path validation vulnerability resulting in arbitrary file disclosure. The flaw stems from insufficient sanitization of the external_data attribute within ONNX model files, which allows an attacker to bypass directory constraints when resolving external resource paths.\nBy crafting a malicious ONNX model, an unauthenticated attacker can force the MmapDataResolver to read sensitive local files and incorporate their contents into model tensors or inference outputs.\nThis vulnerability impacts Tract versions prior to 0.21.17, 0.22.3, and 0.23.2. Beyond information disclosure, the vulnerability also enables a denial-of-service condition by leveraging out-of-range offset and length fields during memory mapping.\nThe risk is high for applications that process untrusted ONNX models, as the toolkit does not perform necessary validation on file paths or memory mapping boundaries, potentially exposing system files to the inference process.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the tract-onnx crate, specifically located in onnx/src/tensor.rs within the get_external_resources function. When the Tract engine processes an ONNX model, it parses the external_data field to resolve dependencies. The implementation fails to sanitize the provided path, allowing the inclusion of absolute path references or directory traversal sequences (e.g., '../') when joining the path to the model's base directory.\nThe attack flow commences when a user or automated system loads a maliciously crafted ONNX model using the model_for_path function. An attacker embeds arbitrary file paths into the model's external_data metadata. Because the application logic does not restrict the resolver to a designated sandbox or model directory, the MmapDataResolver in onnx/src/data_resolver.rs treats these attacker-supplied paths as valid targets. Consequently, the engine maps the contents of arbitrary system files into memory buffers intended for model tensors.\nOnce the file contents are loaded into these tensors, the data can be exfiltrated or processed via standard inference output channels. This permits an attacker to read sensitive information from the filesystem, such as configuration files, credential stores, or system data, depending on the permissions of the process running the inference toolkit.\nAdditionally, the vulnerability permits the manipulation of offset and length parameters associated with the memory mapping process. By providing malformed or out-of-range values, an attacker can trigger a panic or crash within the memory mapping logic, resulting in a denial-of-service (DoS) condition. While the vulnerability does not directly provide a mechanism for arbitrary code execution or filesystem modification, the ability to read arbitrary files and crash the runtime environment represents a significant security failure in the context of inference-as-a-service or localized model deployment scenarios.\nAffected versions include all instances of the tract-onnx crate prior to the release of 0.21.17, 0.22.3, and 0.23.2. The flaw is inherent in the way path resolution logic ignores security boundaries, affecting any application integrating these specific versions of the Tract toolkit."
}