Keras-team vulnerabilities
We track 7 vulnerabilities in Keras-team products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on July 19, 2026.
Latest Keras-team vulnerabilities
- 7.8 High severity
keras-team/keras: Deserialization of Untrusted Data
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` witho
- 9.8 Critical severity
keras-team/keras: Deserialization of Untrusted Data
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when
- 8.1 High severity
keras-team/keras: Improper Limitation of a Pathname to a Restricted Directory
Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against th
- 7.8 High severity
keras-team/keras: Deserialization of Untrusted Data
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `saf
- 8.0 High severity
keras-team/keras: Improper Limitation of a Pathname to a Restricted Directory
Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter
- 7.3 High severity
Keras: Deserialization of Untrusted Data
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This i
- 7.3 High severity
Keras: Improper Control of Dynamically-Managed Code Resources
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. Thi