Allen Householder

**Name of the Vulnerable Software and Affected Versions** TensorFlow's Keras framework versions prior to 2.13 **Description** A code injection issue in TensorFlow's Keras framework allows attackers to execute arbitrary code with the same permissions as the application. This can be achieved by using a model that permits arbitrary code execution, regardless of the application's permissions. The vulnerability can be exploited when loading a model created with an older version, potentially bypassing a patch. **Recommendations** For versions prior to 2.13, consider disabling the use of models created with older versions until a patch is available. As a temporary workaround, restrict the loading of models to minimize the risk of exploitation. Avoid using the LambdaLayer in Keras until the issue is resolved.