CVE-2026-55832Published
Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-55832 · Microsoft / collected KEV context
cve-program · CVE-2026-55832
- https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5
- https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f
- https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98
- https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632
- https://github.com/sonos/tract/releases/tag/0.21.17
- https://github.com/sonos/tract/releases/tag/0.22.3
- https://github.com/sonos/tract/releases/tag/v0.23.2
euvd · EUVD-2026-77721
- https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5
- https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f
- https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98
- https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632
- https://github.com/sonos/tract/releases/tag/0.21.17
- https://github.com/sonos/tract/releases/tag/0.22.3
- https://github.com/sonos/tract/releases/tag/v0.23.2
nvd · CVE-2026-55832
- https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f
- https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98
- https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632
- https://github.com/sonos/tract/releases/tag/0.21.17
- https://github.com/sonos/tract/releases/tag/0.22.3
- https://github.com/sonos/tract/releases/tag/v0.23.2
- https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5
osv · GHSA-h668-6x6g-f8r5
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.