What is the CVSS score of CVE-2026-9335?

CVE-2026-9335 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-9335?

Yes, a patch is available for CVE-2026-9335. Update the affected software to the latest version immediately.

Keras CVE-2026-9335

Q: Which versions of Keras are affected by CVE-2026-9335?

Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a malicious model file to exfiltrate arbitrary local filesystem data from a…. A patch is available.

EUVD-2026-51922 MEDIUM

Path Traversal (CWE-22)

2026-08-02 @huntr_ai

GHSA-m8wh-29wm-52mv

Path Traversal Information Disclosure Keras Team Keras

6.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:N because the malicious file is delivered over the network; UI:R because the victim must actively invoke a Keras loading function; no integrity or availability impact from file disclosure alone.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 02, 2026 - 06:01 EUVD

Source Code Evidence Fetched

Aug 02, 2026 - 05:12 vuln.today

Analysis Generated

Aug 02, 2026 - 05:12 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

AnalysisAI

Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a malicious model file to exfiltrate arbitrary local filesystem data from a victim's machine. Both the KerasFileEditor class and keras.saving.load_weights function fail to invoke the safe_get_h5_group and safe_get_h5_dataset helpers before traversing HDF5 group children, causing automatic dereferencing of embedded ExternalLinks and SoftLinks that point to attacker-controlled paths on the victim's filesystem. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft H5 file with ExternalLink to target path

Delivery

Distribute malicious file to victim

Exploit

Victim loads file via Keras API

Execution

ExternalLink auto-dereferences to local filesystem

Persist

Sensitive HDF5 file content extracted into model/editor state

Impact

Attacker retrieves data via application output or side channel

Access

Craft H5 file with ExternalLink to target path

Delivery

Distribute malicious file to victim

Exploit

Victim loads file via Keras API

Execution

ExternalLink auto-dereferences to local filesystem

Persist

Sensitive HDF5 file content extracted into model/editor state

Impact

Attacker retrieves data via application output or side channel

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively load a malicious .h5, .weights.h5, or .keras file using either `KerasFileEditor` or `keras.saving.load_weights` on a machine running keras-team/keras 3.14.0 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.0 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately reflects the attack profile: network-deliverable, low complexity, no attacker privileges required, but dependent on the victim actively loading a malicious file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious attacker_payload.weights.h5 file containing an HDF5 ExternalLink at the expected 'layers' key, pointing to a sensitive file on the victim's filesystem such as another model file, a private key stored in HDF5 format, or any HDF5-parseable configuration artifact. The attacker distributes this file via a model-sharing platform, a research forum, or a direct download link, social-engineering the victim into loading it with `KerasFileEditor(attacker_payload.weights.h5)` or `model.load_weights(attacker_payload.weights.h5)`. …
Remediation	Upgrade keras-team/keras to any version that incorporates commit 23370f16b0ab9a200f7550a34e54a3ceab74ba0e (https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e); the upstream fix in git is confirmed but an exact tagged release version was not provided in the available intelligence - verify the installed version includes this commit before treating the environment as patched. … Detailed patch versions, workarounds, and compensating controls in full report.