KerasGHSA-4f3f-g24h-fr8m
Keras has an untrusted deserialization vulnerability
High8.8CVE-2026-1462 · Published Apr 13, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| keras PyPI | < 3.13.2 | 3.13.2 |
Details and references
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2026-1462, PYSEC-2026-2547
More Keras advisories
All Keras| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 6 | Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor) CVE-2026-0897Highfixed in 3.12.1, 3.13.2 | High | 3.12.1, 3.13.2 |
| Feb 18 | Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading CVE-2026-1669High7.1fixed in 3.12.1, 3.13.2 | High7.1 | 3.12.1, 3.13.2 |
| Jun 11 | Keras archive extraction utilities allow path traversal and arbitrary file writes CVE-2026-11816High8.1fixed in 3.14.0 | High8.1 | 3.14.0 |
| Jun 22 | Keras: DiskIOStore permits path traversal through crafted layer names CVE-2026-12479Medium6.1fixed in 3.12.3, 3.15.0 | Medium6.1 | 3.12.3, 3.15.0 |
| Jul 1 | Keras: HDF5 virtual datasets can disclose local files CVE-2026-12480Medium5.5fixed in 3.12.3, 3.15.0 | Medium5.5 | 3.12.3, 3.15.0 |
| Jul 3 | Keras: Lambda deserialization can bypass safe mode and execute code CVE-2026-12481High8.8fixed in 3.12.3, 3.15.0 | High8.8 | 3.12.3, 3.15.0 |