PT-2026-61515 · Keras · Keras
CVE-2026-12484
·
Published
2026-04-20
·
Updated
2026-07-20
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
keras-team/keras version 3.15.0
Description
Unsafe deserialization of attacker-controlled PyTorch pickle data occurs through the public
keras.layers.TorchModuleWrapper.from config method. This happens because the method invokes torch.load(..., weights only=False) without requiring an explicit unsafe opt-in, such as a safe mode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default, which can lead to arbitrary code execution if untrusted Keras layer configurations are processed.Recommendations
Update keras-team/keras to a version newer than 3.15.0.
As a temporary mitigation, ensure that the
keras.layers.TorchModuleWrapper.from config method is called within a SafeModeScope(True) context to enforce safe deserialization.Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Keras