Keras: HDF5 virtual datasets can disclose local files
Medium5.5CVE-2026-12480 · Published Jul 1, 2026 · updated Aug 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| keras PyPI | < 3.12.3 | 3.12.3 |
| >= 3.13.0, < 3.15.0 | 3.15.0 |
Details and references
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the `H5IOStore._verify_dataset()` and `file_editor.py` methods, which fail to check the `dataset.is_virtual` property of HDF5 datasets. This allows an attacker to craft a malicious `.keras` model archive or `.h5` weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using `keras.models.load_model()` or `keras.saving.load_model()`, the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.
- CVSS 3.0
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-73
- Also known as
- CVE-2026-12480, PYSEC-2026-3629
- nvd.nist.gov/vuln/detail/CVE-2026-12480
- github.com/keras-team/keras/commit/8f987f11bf7512f0df4774a8f1557bba07dc2b49
- github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c
- github.com/keras-team/keras
- github.com/keras-team/keras/releases/tag/v3.12.3
- github.com/keras-team/keras/releases/tag/v3.15.0
- huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7
More Keras advisories
All Keras| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 3 | Keras: Lambda deserialization can bypass safe mode and execute code CVE-2026-12481High8.8fixed in 3.12.3, 3.15.0 | High8.8 | 3.12.3, 3.15.0 |
| Jun 22 | Keras: DiskIOStore permits path traversal through crafted layer names CVE-2026-12479Medium6.1fixed in 3.12.3, 3.15.0 | Medium6.1 | 3.12.3, 3.15.0 |
| Jul 14 | Keras: tar extraction permits symlink-based path traversal CVE-2026-12482Low3.1fixed in 3.12.3, 3.15.0 | Low3.1 | 3.12.3, 3.15.0 |
| Jul 19 | Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data CVE-2026-12484High7.8fixed in 3.12.3, 3.15.0 | High7.8 | 3.12.3, 3.15.0 |
| Jun 11 | Keras archive extraction utilities allow path traversal and arbitrary file writes CVE-2026-11816High8.1fixed in 3.14.0 | High8.1 | 3.14.0 |
| Aug 2 | Keras: HDF5 links can disclose local file contents CVE-2026-9335Medium6.5fixed in 3.12.3, 3.15.0 | Medium6.5 | 3.12.3, 3.15.0 |