EUVD-2026-21970
GHSA-4f3f-g24h-fr8m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Blast Radius
ecosystem impact- 7 pypi packages depend on keras (5 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.13.2.
DescriptionCVE.org
A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the from_config() method.
AnalysisAI
Remote code execution in Keras 3.13.0 allows unauthenticated attackers to execute arbitrary code by crafting malicious .keras model files that load attacker-controlled TensorFlow SavedModels during deserialization, bypassing safe_mode protections. Exploitation requires user interaction (victim must load the malicious model), but no authentication is required to deliver the payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Victim must load a crafted `.keras` model file in Keras 3.13.0 using `safe_mode=True`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is HIGH despite requiring user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a seemingly legitimate pre-trained Keras model for image classification on a public repository like Hugging Face or GitHub, advertising high accuracy on a popular benchmark dataset. A data scientist downloads the .keras file and loads it in their Jupyter notebook using keras.models.load_model() with safe_mode=True, believing the safety flag provides protection. … |
| Remediation | Upstream fix available via GitHub commit b6773d3decaef1b05d8e794458e148cb362f163f; released patched version not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Keras 3.13.0 and identify users who load external .keras model files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today