What is the CVSS score of EUVD-2026-51922?

EUVD-2026-51922 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for EUVD-2026-51922?

Yes, a patch is available for EUVD-2026-51922. Update the affected software to the latest version immediately.

Keras EUVD-2026-51922

Q: Which versions of Keras are affected by EUVD-2026-51922?

Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a malicious model file to exfiltrate arbitrary local filesystem data from a…. A patch is available.

| CVE-2026-9335 MEDIUM

Path Traversal (CWE-22)

2026-08-02 @huntr_ai

GHSA-m8wh-29wm-52mv

Information Disclosure Path Traversal Keras Team Keras Keras Team

6.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:N because the malicious file is delivered over the network; UI:R because the victim must actively invoke a Keras loading function; no integrity or availability impact from file disclosure alone.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 02, 2026 - 06:01 EUVD

Source Code Evidence Fetched

Aug 02, 2026 - 05:12 vuln.today

Analysis Generated

Aug 02, 2026 - 05:12 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on keras (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.13.0.

DescriptionCVE.org

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, KerasFileEditor extracts attributes and datasets from linked files into its internal structures, while keras.saving.load_weights loads weights from linked files into the user's model. This issue can be exploited by providing a malicious .h5, .weights.h5, or .keras file containing ExternalLinks.

AnalysisAI

Local HDF5 file content disclosure in keras-team/keras versions 3.14.0 and earlier allows an attacker who can deliver a malicious model file to exfiltrate arbitrary local filesystem data from a victim's machine. Both the KerasFileEditor class and keras.saving.load_weights function fail to invoke the safe_get_h5_group and safe_get_h5_dataset helpers before traversing HDF5 group children, causing automatic dereferencing of embedded ExternalLinks and SoftLinks that point to attacker-controlled paths on the victim's filesystem. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the attack mechanism is straightforward and the commit diff makes the vulnerability trivially reproducible.

Technical ContextAI

Keras uses the HDF5 file format (via the h5py library) to store and load model weights in .h5, .weights.h5, and .keras files. HDF5 supports two link types beyond normal hard links: ExternalLinks, which reference a group or dataset inside a separate HDF5 file on the local filesystem by path, and SoftLinks, which reference a path within the same file symbolically. The h5py library automatically dereferences these links during traversal unless explicitly checked. Keras had implemented safe wrapper helpers - safe_get_h5_group and safe_get_h5_dataset - that detect and reject ExternalLink and SoftLink objects before access, but KerasFileEditor._extract_weights_from_store called data.get(key) directly, bypassing these guards entirely. Under CWE-22 (Path Traversal), the attacker controls the filesystem path embedded in the ExternalLink, directing Keras to read any HDF5-parseable file the victim process can access. Affected product per CPE: cpe:2.3:a:keras-team:keras-team/keras:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade keras-team/keras to any version that incorporates commit 23370f16b0ab9a200f7550a34e54a3ceab74ba0e (https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e); the upstream fix in git is confirmed but an exact tagged release version was not provided in the available intelligence - verify the installed version includes this commit before treating the environment as patched. Until a patched package is deployed, the most effective compensating control is to never load HDF5 model files from untrusted or unverified sources; this is actionable for teams with controlled model provenance pipelines. For applications that must accept user-supplied model files, consider sandboxing the Keras loading process in a restricted environment (e.g., a container with no access to sensitive local files) so that any ExternalLink dereference can only reach an empty or isolated filesystem. Disabling or restricting access to the KerasFileEditor API surface in production inference services is advisable as a defense-in-depth measure. The full vulnerability report is at https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5.