"tract" (the "tract-onnx" crate) resolves an ONNX tensor's external-data "location" by joining it onto the model directory without any sanitization. Because "location" comes from the (untrusted) ".onnx" file, a malicious model can make "tract" open and read an arbitrary local file at load time, with the file's contents flowing into the model's tensors / inference output (read-only file disclosure). This is the ONNX external-data path-traversal class that the reference "onnx" library hardened over several CVEs; "tract" resolves "location" itself and was never hardened.