Keras
Monthly
Path traversal in Keras archive extraction utilities prior to version 3.14.0 allows remote attackers to write files outside the intended extraction directory when a victim loads a malicious model archive. The flaw stems from validating archive member paths against the process current working directory rather than the actual extraction destination, which collapses to the filesystem root in common Docker, CI/CD, and Jupyter setups. No public exploit identified at time of analysis, but the upstream fix and a Huntr bounty disclosure make targeted exploitation against ML pipelines plausible.
Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 allows a remote attacker to read sensitive files from a victim's system by tricking them into loading a malicious .keras model that abuses HDF5 external dataset references in the model-loading path. Exploitation requires the victim to open the attacker-supplied model (UI:P), but no authentication is needed; EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpreter by getting a victim to load a malicious .keras model archive. The crafted archive embeds a valid model.weights.h5 HDF5 file whose dataset declares an enormously large shape, so the weight loader attempts to allocate unbounded memory during deserialization. There is no public exploit identified at time of analysis, EPSS risk is low (0.03%), and a vendor fix is available.
Directory traversal in Keras through 3.11.3 allows an attacker who supplies a crafted tar archive to keras.utils.get_file(..., extract=True) to write files outside the intended extraction directory, including via symlink-based traversal that bypasses Keras's existing path filter. The issue is tied to Python tarfile's PATH_MAX symlink-resolution behavior (CVE-2025-4517) and to Keras calling tarfile.extractall without filter='data'; upgrading Python alone does not remediate it. Publicly available exploit code exists (a proof-of-concept is included in the GitHub advisory), exploitation requires the victim application to fetch and extract an attacker-influenced tar archive, and no CISA KEV entry is available.
Keras Model.load_model fails to enforce safe_mode=True for the StringLookup layer's vocabulary path handling, so a malicious .keras archive can cause arbitrary local file reads and server-side requests when a victim loads it. This CWE-502 deserialization-class flaw affects the Keras model-loading path and is assessed as confidentiality-focused, requiring user interaction to load the untrusted model; SSRF reach depends on the host's network access and available tf.io.gfile handlers. No public exploit was identified at time of analysis.
Deserialization of untrusted data in Keras 3.11.0 through 3.11.2 allows remote code execution when a victim loads a maliciously crafted Keras model file containing a TorchModuleWrapper, even with safe mode enabled (the default). The bypass occurs because torch.load() is invoked during from_config() deserialization without the safe-mode check; exploitation requires user interaction to load the file, which can be local or fetched from a remote URL. No public exploit code or confirmed active exploitation was identified at time of analysis, but the unauthenticated network vector and high impact make this critical.
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated high severity (CVSS 7.3). Public exploit code available.
A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path traversal in Keras archive extraction utilities prior to version 3.14.0 allows remote attackers to write files outside the intended extraction directory when a victim loads a malicious model archive. The flaw stems from validating archive member paths against the process current working directory rather than the actual extraction destination, which collapses to the filesystem root in common Docker, CI/CD, and Jupyter setups. No public exploit identified at time of analysis, but the upstream fix and a Huntr bounty disclosure make targeted exploitation against ML pipelines plausible.
Arbitrary local file disclosure in Keras 3.0.0 through 3.13.1 allows a remote attacker to read sensitive files from a victim's system by tricking them into loading a malicious .keras model that abuses HDF5 external dataset references in the model-loading path. Exploitation requires the victim to open the attacker-supplied model (UI:P), but no authentication is needed; EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Memory-exhaustion denial of service in Google Keras 3.0.0 through 3.13.0 lets a remote attacker crash the Python interpreter by getting a victim to load a malicious .keras model archive. The crafted archive embeds a valid model.weights.h5 HDF5 file whose dataset declares an enormously large shape, so the weight loader attempts to allocate unbounded memory during deserialization. There is no public exploit identified at time of analysis, EPSS risk is low (0.03%), and a vendor fix is available.
Directory traversal in Keras through 3.11.3 allows an attacker who supplies a crafted tar archive to keras.utils.get_file(..., extract=True) to write files outside the intended extraction directory, including via symlink-based traversal that bypasses Keras's existing path filter. The issue is tied to Python tarfile's PATH_MAX symlink-resolution behavior (CVE-2025-4517) and to Keras calling tarfile.extractall without filter='data'; upgrading Python alone does not remediate it. Publicly available exploit code exists (a proof-of-concept is included in the GitHub advisory), exploitation requires the victim application to fetch and extract an attacker-influenced tar archive, and no CISA KEV entry is available.
Keras Model.load_model fails to enforce safe_mode=True for the StringLookup layer's vocabulary path handling, so a malicious .keras archive can cause arbitrary local file reads and server-side requests when a victim loads it. This CWE-502 deserialization-class flaw affects the Keras model-loading path and is assessed as confidentiality-focused, requiring user interaction to load the untrusted model; SSRF reach depends on the host's network access and available tf.io.gfile handlers. No public exploit was identified at time of analysis.
Deserialization of untrusted data in Keras 3.11.0 through 3.11.2 allows remote code execution when a victim loads a maliciously crafted Keras model file containing a TorchModuleWrapper, even with safe mode enabled (the default). The bypass occurs because torch.load() is invoked during from_config() deserialization without the safe-mode check; exploitation requires user interaction to load the file, which can be local or fetched from a remote URL. No public exploit code or confirmed active exploitation was identified at time of analysis, but the unauthenticated network vector and high impact make this critical.
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. Rated high severity (CVSS 7.3). Public exploit code available.
A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available.
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.