{"id":"CVE-2026-92610","kind":"vulnerability","aliases":["CVE-2026-92610"],"related":[],"title":"esmf-sdk Python loader: crafted Turtle file reads Turtle files outside models folder","description":"In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.","summary":"The esmf-sdk-py-aspect-model-loader Python package, versions 2.1.2 to 2.2.1, builds scan directories from urn:samm namespace text inside a parsed Turtle model file. A crafted namespace with path traversal or an absolute path makes it glob and parse other .ttl files outside the models root and merge them into the loaded graph.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspect-model","esmf-sdk","package","python","samm"],"not_affected_if":["trusted-model-files-only","versions-outside-2.1.2-2.2.1"],"how_to_check":"- Check the installed version with `pip show esmf-sdk-py-aspect-model-loader` or the version pinned in your lock file.\n- Find where Aspect Model files come from; if untrusted users or external sources can supply .ttl files to the loader, treat it as exposed.","fix":"- Move to a version newer than `2.2.1`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-03T09:17:13+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","triaged_at":"2026-11-03T09:20:33+00:00","updated_at":"2026-11-03T09:20:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `2.2.1`; the sources do not name the fixed version.","reach":"local","title":"esmf-sdk Python loader: crafted Turtle file reads Turtle files outside models folder","impact":"medium","summary":"The esmf-sdk-py-aspect-model-loader Python package, versions 2.1.2 to 2.2.1, builds scan directories from urn:samm namespace text inside a parsed Turtle model file. A crafted namespace with path traversal or an absolute path makes it glob and parse other .ttl files outside the models root and merge them into the loaded graph.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","esmf-sdk","aspect-model","samm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"other local .ttl files are read and merged into loaded model data","analyst_note":"Confirm the fixed version and whether the flaw is reachable only via attacker-supplied model files; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-92610.","how_to_check":"- Check the installed version with `pip show esmf-sdk-py-aspect-model-loader` or the version pinned in your lock file.\n- Find where Aspect Model files come from; if untrusted users or external sources can supply .ttl files to the loader, treat it as exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-model-files-only","versions-outside-2.1.2-2.2.1"],"who_is_affected":"Teams that load Aspect Model Turtle files with esmf-sdk-py-aspect-model-loader 2.1.2 through 2.2.1 are exposed, most of all if model files come from users or outside sources. Systems that only load models they author and store themselves are less exposed, since the flaw needs a crafted namespace declaration in a model file. unknown whether any default configuration matters beyond this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4234,"output_tokens":717,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-92610':17A,20A '/../../foo':144C '/abs/path':151C '2.1.2':41B,96C '2.2.1':43B,98C 'absolut':66B 'arbitrari':163C 'aspect':22B,35B,92C,100C 'aspect-model':21B 'bar':145C,152C 'build':44B,131C 'caus':153C 'colon':116C 'colon-separ':115C 'compon':118C 'contain':139C 'content':172C 'craft':6A,59B 'cross':105C 'cross-fil':104C 'cve':15A,18A 'declar':124C 'directori':46B,133C,164C 'esmf':2A,25B,32B,89C 'esmf-sdk':1A,24B 'esmf-sdk-py-aspect-model-load':31B,88C 'extract':110C 'file':8A,11A,57B,75B,106C,129C,138C,161C 'folder':14A 'fourth':114C 'glob':70B,157C 'graph':86B,176C 'insid':52B 'intend':167C 'load':85B 'loader':5A,37B,94C,102C,155C 'make':68B 'merg':81B,170C 'model':13A,23B,36B,56B,78B,93C,101C,107C,137C,168C 'namespac':50B,60B,123C 'outsid':12A,76B,165C 'packag':27B,39B 'pars':54B,72B,127C,159C 'path':62B,67B 'prefix':140C,147C 'py':34B,91C 'python':4A,28B,38B 'read':9A 'refer':108C 'resolv':103C 'return':175C 'root':79B,169C 'samm':29B,49B,122C,143C,150C 'scan':45B,135C 'sdk':3A,26B,33B,90C 'separ':117C 'text':51B 'third':112C 'travers':63B 'ttl':74B,160C 'turtl':7A,10A,55B,128C 'urn':48B,121C,142C,149C 'version':40B,95C 'x':141C,148C","nicknames":[],"mitigations":[],"who_affected":"Teams that load Aspect Model Turtle files with esmf-sdk-py-aspect-model-loader 2.1.2 through 2.2.1 are exposed, most of all if model files come from users or outside sources. Systems that only load models they author and store themselves are less exposed, since the flaw needs a crafted namespace declaration in a model file. unknown whether any default configuration matters beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspectmodel","esmfsdk","medium","package","python","samm"],"first_public_at":"2026-11-03T09:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92610","severity":null,"published_at":"2026-11-03T09:17:13+00:00","modified_at":"2026-11-03T09:17:13+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","fetched_at":"2026-11-03T09:19:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}