KerasGHSA-cjgq-5qmw-rcj6
keras Path Traversal vulnerability
MediumCVE-2024-55459 · Published Jan 8, 2025 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| keras PyPI | <= 3.7.0 | No fix yet |
Details and references
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2024-55459, PYSEC-2025-121
- nvd.nist.gov/vuln/detail/CVE-2024-55459
- github.com/keras-team/keras
- github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py#L115
- github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-121.yaml
- keras.io
- river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
More Keras advisories
All Keras| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 112025 | Arbitrary Code Execution via Crafted Keras Config for Model Loading CVE-2025-1550Highfixed in 3.9.0 | High | 3.9.0 |
| Aug 122025 | Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality CVE-2025-8747High8.8fixed in 3.11.0 | High8.8 | 3.11.0 |
| Sep 192025 | Keras is vulnerable to Deserialization of Untrusted Data CVE-2025-9906High7.3fixed in 3.11.0 | High7.3 | 3.11.0 |
| Sep 192025 | The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded. CVE-2025-9905Highfixed in 3.11.3 | High | 3.11.3 |
| Apr 162024 | Keras code injection vulnerability CVE-2024-3660Critical9.8fixed in 2.13.1rc0 | Critical9.8 | 2.13.1rc0 |
| Oct 172025 | Keras framework vulnerable to deserialization of untrusted data CVE-2025-49655Critical9.8fixed in 3.11.3 | Critical9.8 | 3.11.3 |