{"kind": "product", "path": "vulns/ubuntu-18.04-lts/keras", "name": "keras", "product": "keras", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2026-12570", "noindex": false, "published": "2026-08-10T06:29:56.111Z", "modified": "2026-08-10T17:37:39.037Z", "cvss": 5.5, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12570", "title": "Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras", "description": "A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/saving_lib.py does not validate the shape or size of datasets, leading to unbounded memory allocation. A specially crafted .keras file can exploit this flaw to trigger an out-of-memory (OOM) condition, causing the process to be terminated (exit code 137). This issue bypasses the fix for CVE-2026-0897, which only addressed a similar vulnerability in KerasFileEditor. The attack vector includes poisoned models f", "references": ["https://huntr.com/bounties/a064f475-780a-409a-82f7-678512f27ad8", "https://github.com/keras-team/keras/commit/4933ea4a5b3fcc24ceacdc276f5bb5dfbd06756c", "https://nvd.nist.gov/vuln/detail/CVE-2026-12570"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-9335", "noindex": false, "published": "2026-08-02T03:49:25.096Z", "modified": "2026-08-03T16:48:20.064Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00767, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-9335", "title": "Improper Handling of HDF5 ExternalLinks in keras-team/keras", "description": "A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads", "references": ["https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5", "https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e", "https://nvd.nist.gov/vuln/detail/CVE-2026-9335"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-12484", "noindex": false, "published": "2026-07-19T19:47:27.743Z", "modified": "2026-07-20T13:45:55.809Z", "cvss": 7.8, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00304, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12484", "title": "Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config", "description": "A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not", "references": ["https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28", "https://nvd.nist.gov/vuln/detail/CVE-2026-12484"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-12482", "noindex": false, "published": "2026-07-14T05:13:07.252Z", "modified": "2026-07-14T12:43:09.817Z", "cvss": 3.1, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12482", "title": "Path Traversal via Symlink Name Validation Bypass in keras-team/keras", "description": "A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-1", "references": ["https://huntr.com/bounties/5d3638e8-a9f6-4964-a865-ddb9fe4d4b6e", "https://nvd.nist.gov/vuln/detail/CVE-2026-12482"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-12481", "noindex": false, "published": "2026-07-03T20:36:05.003Z", "modified": "2026-07-06T15:15:46.244Z", "cvss": 8.8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00719, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12481", "title": "Deserialization of Untrusted Data in keras-team/keras", "description": "A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.cl", "references": ["https://huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d", "https://nvd.nist.gov/vuln/detail/CVE-2026-12481"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-12480", "noindex": false, "published": "2026-07-01T16:53:32.326Z", "modified": "2026-07-01T17:46:31.093Z", "cvss": 5.5, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0019, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12480", "title": "Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras", "description": "Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential info", "references": ["https://huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7", "https://github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c", "https://nvd.nist.gov/vuln/detail/CVE-2026-12480"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-12479", "noindex": false, "published": "2026-06-22T15:21:19.645Z", "modified": "2026-06-22T16:29:55.106Z", "cvss": 6.1, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "severity": "medium", "epss": 0.00362, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12479", "title": "Path Traversal in keras-team/keras", "description": "A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (`..`). While forward slashes (`/`) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as", "references": ["https://huntr.com/bounties/188836b9-12fc-49c7-8dbf-04f60fe33743", "https://nvd.nist.gov/vuln/detail/CVE-2026-12479"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-11816", "noindex": false, "published": "2026-06-11T13:31:52.492Z", "modified": "2026-07-21T12:05:17.381Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00563, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-11816", "title": "Path Traversal in keras-team/keras", "description": "Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is common in Docker containers, CI/CD runners, and Jupyter environments, the validation boundary becomes the filesystem root, allowing traversal paths to bypass the security check. Additionally, the zip filter contains a bug that causes an `AttributeErr", "references": ["https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f", "https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888", "https://access.redhat.com/security/cve/CVE-2026-11816"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-1462", "noindex": false, "published": "2026-04-13T14:55:28.649Z", "modified": "2026-07-15T01:21:47.957Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-1462", "title": "Safe Mode Bypass in keras-team/keras", "description": "A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.", "references": ["https://huntr.com/bounties/7e78d6f1-6977-4300-b595-e81bdbda331c", "https://github.com/keras-team/keras/commit/b6773d3decaef1b05d8e794458e148cb362f163f", "https://access.redhat.com/security/cve/CVE-2026-1462"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-1669", "noindex": false, "published": "2026-02-11T22:10:10.031Z", "modified": "2026-07-15T01:21:16.008Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00334, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-1669", "title": "Arbitrary File Read in Keras via HDF5 External Datasets", "description": "Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.", "references": ["https://github.com/google/security-research/security/advisories", "https://access.redhat.com/security/cve/CVE-2026-1669", "https://bugzilla.redhat.com/show_bug.cgi?id=2439205"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-0897", "noindex": false, "published": "2026-01-15T14:09:53.603Z", "modified": "2026-07-15T01:23:41.519Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0033, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-0897", "title": "Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata", "description": "Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras archive containing a valid model.weights.h5 file whose dataset declares an extremely large shape.", "references": ["https://github.com/keras-team/keras/pull/21880", "https://access.redhat.com/security/cve/CVE-2026-0897", "https://bugzilla.redhat.com/show_bug.cgi?id=2430027"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-12638", "noindex": false, "published": "2025-11-28T14:06:02.069Z", "modified": "2025-11-28T15:08:13.714Z", "cvss": 8, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0071, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12638", "title": "Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()", "description": "Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead ", "references": ["https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4", "https://nvd.nist.gov/vuln/detail/CVE-2025-12638"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-12060", "noindex": false, "published": "2025-10-30T17:10:43.868Z", "modified": "2026-02-26T16:56:46.808Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "high", "epss": 0.00631, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12060", "title": "Keras keras.utils.get_file Utility Path Traversal Vulnerability", "description": "The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter=\"data\" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not en", "references": ["https://github.com/keras-team/keras/pull/21760", "https://github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9", "https://nvd.nist.gov/vuln/detail/CVE-2025-12060"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-12058", "noindex": false, "published": "2025-10-29T08:48:29.689Z", "modified": "2025-10-29T14:11:03.027Z", "cvss": 5.9, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L", "severity": "medium", "epss": 0.00248, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12058", "title": "Vulnerability in Keras Model.load_model Leading to Arbitrary Local File Loading and SSRF", "description": "The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF).\n\n\nThis vulnerability stems from the way the StringLookup layer is handled during model loading from a specially crafted .keras archive. The constructor for the StringLookup layer accepts a vocabulary argument that can specify a local file path or a remote file path.\n\n  *  Arbitrary Local File Read: An attacker can create a malicious .keras file that embeds a local path in the StringLookup layer's configuration. When the model is loaded, Keras will", "references": ["https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f", "https://github.com/keras-team/keras/pull/21751", "https://nvd.nist.gov/vuln/detail/CVE-2025-12058"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-49655", "noindex": false, "published": "2025-10-17T15:20:27.308Z", "modified": "2025-10-17T15:58:34.204Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.0075, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-49655", "title": "CVE-2025-49655", "description": "Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.", "references": ["https://hiddenlayer.com/sai_security_advisor/2025-10-keras/", "https://github.com/keras-team/keras/pull/21575", "https://nvd.nist.gov/vuln/detail/CVE-2025-49655"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-9905", "noindex": false, "published": "2025-09-19T08:16:44.772Z", "modified": "2026-02-26T17:48:23.327Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "high", "epss": 0.00221, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-9905", "title": "Arbitary Code execution in Keras load_model()", "description": "The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.\n\nThis is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.\n\nNote that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.", "references": ["https://github.com/keras-team/keras/pull/21602", "https://github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjv", "https://nvd.nist.gov/vuln/detail/CVE-2025-9905"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-9906", "noindex": false, "published": "2025-09-19T08:15:04.349Z", "modified": "2026-02-26T17:48:23.819Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:A", "severity": "high", "epss": 0.00203, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-9906", "title": "Arbitrary Code execution in Keras Safe Mode", "description": "The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserializat", "references": ["https://github.com/keras-team/keras/pull/21429", "https://nvd.nist.gov/vuln/detail/CVE-2025-9906"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-8747", "noindex": false, "published": "2025-08-11T07:21:16.619Z", "modified": "2026-02-26T17:49:45.906Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:A", "severity": "high", "epss": 0.00118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-8747", "title": "Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.", "description": "A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.", "references": ["https://github.com/keras-team/keras/pull/21429", "https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability/", "https://nvd.nist.gov/vuln/detail/CVE-2025-8747"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2025-1550", "noindex": false, "published": "2025-03-11T08:12:34.974Z", "modified": "2025-07-24T15:28:42.230Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "high", "epss": 0.02626, "kev": false, "exploits": ["exploitdb", "public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-1550", "title": "Arbitrary Code Execution via Crafted Keras Config for Model Loading", "description": "The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.", "references": ["https://github.com/keras-team/keras/pull/20751", "https://towerofhanoi.it/writeups/cve-2025-1550/", "https://nvd.nist.gov/vuln/detail/CVE-2025-1550"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2024-55459", "noindex": false, "published": "2025-01-08T00:00:00.000Z", "modified": "2025-01-09T14:44:48.850Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00237, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-55459", "title": "CVE-2024-55459", "description": "An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.", "references": ["https://github.com/keras-team/keras", "https://keras.io", "https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32"], "fixes": [], "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "keras", "path": "vulns/ubuntu-18.04-lts/keras", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-10T17:37:39.037Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}