CVE-2026-92610

{"id": "CVE-2026-92610", "cveTags": [], "metrics": {}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Semantic Modeling Framework (ESMF)", "versions": [{"status": "affected", "version": "2.1.2", "versionType": "semver", "lessThanOrEqual": "2.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-11-03T09:17:13.693", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309", "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969", "source": "emo@eclipse.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any\u00a0urn:samm:\u2026\u00a0namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#>\u00a0or @prefix x: <urn:samm:/abs/path:bar#>\u00a0causes the loader to glob and parse\u00a0*.ttl\u00a0files from arbitrary directories outside the intended models root, merging their contents into the returned graph."}], "lastModified": "2026-11-03T16:13:37.520", "sourceIdentifier": "emo@eclipse.org"}