Keras
CVE-2026-1669
HIGH
GHSA-3m4q-jmj6-r34q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft .keras model with HDF5 external dataset reference
-
DeliveryDeliver model via hub or direct share
-
ExploitVictim loads malicious model in Keras
-
ExecutionLoader resolves reference to local path
-
PersistTargeted file contents read into model
-
ImpactSensitive data disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted .keras model file (UI:P - user interaction is the key limiting factor) whose embedded HDF5 weights use external dataset references to point at arbitrary local file paths; the affected feature is the Keras model-loading/HDF5 integration in versions 3.0.0-3.13.1. No authentication or prior access to the target is required (PR:N), and the attack works on default configurations on all supported platforms, but it cannot fire passively - the user must actively open/deserialize the malicious model, and the attacker must know or guess the absolute/relative path of the file they wish to read. Impact is limited to disclosure of files readable by the process running Keras. |
| Impact | Signals are consistent and point to a moderate, opportunistic risk rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H/VI:L/VA:N) and base score 7.1 describe an unauthenticated, low-complexity attack with high confidentiality impact but gated by required user interaction - the victim must load the malicious model. EPSS is very low (0.01%, percentile 2%), there is no KEV listing and no public exploit identified, so mass exploitation is unlikely; the realistic threat is targeted social-engineering of ML practitioners into opening untrusted models from model hubs or shared artifacts. The primary impact is information disclosure (file read), not code execution or integrity loss, which bounds blast radius. No conflicting signals were observed: network attack vector is plausible because models are commonly shared/downloaded, but practical exploitation still depends on the user-interaction step. |
| Exploit ScenarioDerived | An attacker publishes a seemingly legitimate pre-trained model on a model-sharing hub or sends it directly to an ML engineer; the .keras file embeds an HDF5 external dataset reference pointing to a sensitive local path such as SSH keys, cloud credentials, or configuration files. When the victim loads the model in Keras, the loader follows the reference and pulls the targeted file's contents into the model object, which the attacker can then exfiltrate or read back. No public proof-of-concept is identified at time of analysis, but the low attack complexity makes a working exploit straightforward to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv7 – Jun 30, 2026
Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 allows a remote attacker to read sensitive files from a victim's system by tricking them into loading a malicious .keras model that abuses HDF5 external dataset references in the model-loading path. Exploitation requires the victim to open the attacker-supplied model (UI:P), but no authentication is needed; EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Earlier versions of this analysis (6)
Arbitrary local file disclosure affects the Keras deep-learning framework (versions 3.0.0 through 3.13.1) when it loads a malicious .keras model that abuses HDF5 external dataset references to point at files outside the model archive. A remote attacker who convinces a victim to load a crafted model file can read arbitrary local files in the context of the loading process and exfiltrate their contents. EPSS rates exploitation probability very low (0.01%), and no public exploit identified at time of analysis.
Arbitrary local file read in Keras 3.0.0 through 3.13.1 allows a remote attacker to disclose sensitive files on a victim host when the victim loads a crafted .keras model that abuses HDF5 external dataset references. The bug stems from the model-loading (HDF5) layer trusting attacker-controlled external file paths embedded in the model archive, turning model deserialization into a file-disclosure primitive. With UI required (victim must load the model), EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, but the wide use of Keras in ML pipelines makes untrusted model loading a realistic exposure.
Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 lets a remote attacker exfiltrate sensitive files from a victim's host when that victim loads a maliciously crafted .keras model. The flaw lives in the HDF5 integration of the model-loading path, where HDF5 external dataset references are followed to read files outside the model archive. Exploitation requires the victim to open the attacker-supplied model (UI:P), there is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%), indicating no observed mass exploitation.
Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 lets a remote attacker exfiltrate sensitive files from any host that opens a malicious .keras model. The flaw lives in the HDF5 model-loading path, where external dataset references in the HDF5 container are dereferenced against the local filesystem, so loading an attacker-supplied model reads files such as credentials or private keys and surfaces their contents. No public exploit identified at time of analysis, EPSS is negligible (0.01%), and it is not in CISA KEV, but a vendor patch is available.
Arbitrary local file read in Keras 3.0.0 through 3.13.1 lets a remote attacker disclose sensitive files when a victim loads a crafted .keras model that abuses HDF5 external dataset references during model deserialization. The flaw (CWE-73, external control of filename/path) requires the user to open the attacker-supplied model, but needs no authentication and works across all supported platforms. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile), so this is a credible but low-likelihood, interaction-dependent issue rather than a mass-exploitation threat.
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references. [CVSS 7.5 HIGH]
RemediationAI
Upgrade Keras to a fixed release above 3.13.1 (Patch available per vendor advisory; the exact patched version is not stated in the provided data, so confirm the precise fixed version via the Google security-research advisory at https://github.com/google/security-research/security/advisories and the Red Hat tracker at https://access.redhat.com/security/cve/CVE-2026-1669 before deploying). Until patched, the most effective compensating control is to never load .keras/HDF5 models from untrusted or unverified sources and to treat shared model files as untrusted input; load suspect models only inside a sandboxed, network- and filesystem-isolated environment (e.g., a container with no access to sensitive paths) so any external dataset reference resolves to nothing of value, accepting the trade-off of added workflow friction. Where feasible, inspect/validate model archives for HDF5 external dataset references before loading and prefer the safe-loading paths recommended by the vendor advisory.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keras is a widely used high-level deep-learning API (the default front end for TensorFlow and usable with JAX/PyTorch). The .keras model format is a zip archive that can embed weights stored via HDF5 (the .h5/HDF5 hierarchical data format handled through h5py/libhdf5). HDF5 supports 'external dataset' references, where a dataset's raw bytes are stored in a separate file path declared inside the container; when Keras loads such a model it follows these references, and a crafted file can point them at arbitrary local paths so their contents are read back into the deserialized model. The root cause maps to CWE-73 (External Control of File Name or Path): the model loader trusts file/path references supplied inside untrusted model data instead of constraining reads to the archive.
Know when Keras gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Remotely delivered malicious model but requires the user to load it (UI:R); unauthenticated (PR:N); pure file-read disclosure so C:H, I:N, A:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
9DescriptionCVE.org
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.
Blast Radius
ecosystem impact- 1 pypi packages depend on keras (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.13.0.
Executive ViewAI
Keras machine learning framework (versions 3.0.0-3.13.1) contains a file-disclosure vulnerability that could expose sensitive organizational assets such as credentials and intellectual property when users open malicious model files. Despite minimal current exploitation risk (EPSS 0.01%, no public exploits), the high CVSS severity rating and authentication-free attack vector necessitate prompt patching across all affected deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated
Deserialization of untrusted data in Keras 3.11.0 through 3.11.2 allows remote code execution when a victim loads a mali
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary c
Directory traversal in Keras through 3.11.3 allows an attacker who supplies a crafted tar archive to keras.utils.get_fil
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated
Path traversal in Keras archive extraction utilities prior to version 3.14.0 allows remote attackers to write files outs
Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpr
Keras Model.load_model fails to enforce safe_mode=True for the StringLookup layer's vocabulary path handling, so a malic
A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attac
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar fi
Exploit-DB