TensorLayer CVE-2026-108958

Requires a victim to load an attacker-supplied HDF5 model file through TensorLayer's load_hdf5_graph() with a manipulated model_config argument; no authentication is required (PR:N) but mandatory user interaction (UI:P/R) - the target must obtain and load the malicious model. Exploitation is therefore limited to environments that deserialize untrusted or third-party TensorLayer model files and to versions up to and including 2.2.4; it is NOT reachable against an unattended network-facing service with no file-loading step.

Signals here conflict sharply and skew toward LOW operational priority despite the serious CWE-502 class. The only severity source is VulDB, which rated this CVSS 4.0 2.1 (AV:N/AC:L/AT:N/PR:N/UI:P with only Low VC/VI/VA). That low score contradicts the vulnerability class: deserialization of an untrusted model_config via load_hdf5_graph (CWE-502) in TensorLayer historically means eval-based reconstruction of the model graph, which typically yields arbitrary code execution, not merely low-impact disclosure - so the vendor-of-record impact rating appears understated versus the mechanism. There is NO CISA KEV listing and NO EPSS score in the input, so real-world exploitation frequency cannot be quantified. POC is marked 'publicly available,' but the only 'exploit' reference is a GitHub issue thread (#1169), not verified weaponized code, so publicly available exploit code exists in name though its maturity is unconfirmed (CVSS E:P / 'Proof-of-Concept' corroborates immature exploit status). Critically, exploitation is gated by UI:P/UI:R - a victim must load an attacker-supplied model file - so this is not a remotely reachable service flaw. Net: a low-footprint, now-inactive ML library plus a required user-interaction step plus no KEV/EPSS evidence make this a low real-world priority, even though the underlying class is dangerous for anyone who loads untrusted TensorLayer models.

An attacker publishes or shares a crafted HDF5 model file with a manipulated model_config to a model hub, repository, or directly to a target. When a developer or ML pipeline loads it via TensorLayer's load_hdf5_graph(), the untrusted model_config is deserialized and attacker-controlled logic runs in the victim's process. A public proof-of-concept is referenced via the project's GitHub issue tracker (#1169), though exploit maturity is only proof-of-concept.