Keras: HDF5 links can disclose local file contents
Medium6.5CVE-2026-9335 · Published Aug 2, 2026 · updated Aug 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| keras PyPI | < 3.12.3 | 3.12.3 |
| >= 3.13.0, < 3.15.0 | 3.15.0 |
Details and references
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-9335, PYSEC-2026-3633
- nvd.nist.gov/vuln/detail/CVE-2026-9335
- github.com/keras-team/keras/pull/22899
- github.com/keras-team/keras/pull/23165
- github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e
- github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf
- github.com/keras-team/keras
- github.com/keras-team/keras/releases/tag/v3.12.3
- github.com/keras-team/keras/releases/tag/v3.15.0
- huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5
More Keras advisories
All Keras| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 10 | Keras model loading is vulnerable to denial of service through HDF5 shape bombs CVE-2026-12570Medium5.5fixed in 3.15.0 | Medium5.5 | 3.15.0 |
| Jul 19 | Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data CVE-2026-12484High7.8fixed in 3.12.3, 3.15.0 | High7.8 | 3.12.3, 3.15.0 |
| Jul 14 | Keras: tar extraction permits symlink-based path traversal CVE-2026-12482Low3.1fixed in 3.12.3, 3.15.0 | Low3.1 | 3.12.3, 3.15.0 |
| Jul 3 | Keras: Lambda deserialization can bypass safe mode and execute code CVE-2026-12481High8.8fixed in 3.12.3, 3.15.0 | High8.8 | 3.12.3, 3.15.0 |
| Jul 1 | Keras: HDF5 virtual datasets can disclose local files CVE-2026-12480Medium5.5fixed in 3.12.3, 3.15.0 | Medium5.5 | 3.12.3, 3.15.0 |
| Jun 22 | Keras: DiskIOStore permits path traversal through crafted layer names CVE-2026-12479Medium6.1fixed in 3.12.3, 3.15.0 | Medium6.1 | 3.12.3, 3.15.0 |