Executive brief
Keras, a popular deep learning library, is vulnerable to a security flaw that could allow an attacker to read sensitive files from a user's computer. By tricking a user into loading a specially crafted machine learning model file, an attacker can exploit the way Keras handles certain data formats to access local files they shouldn't be able to see. This could lead to the theft of private data or credentials stored on the victim's system.
Technical details
Keras versions up to 3.13.2 (excluding patched branches) contain a path traversal/information disclosure vulnerability due to an incomplete fix for a previous issue. The vulnerability exists in H5IOStore._verify_dataset() and file_editor.py, which fail to validate the 'dataset.is_virtual' property of HDF5 datasets. An attacker can create a malicious .keras or .h5 file containing a Virtual Dataset (VDS) that points to external files on the host system. When a user calls keras.models.load_model() or keras.saving.load_model(), the library transparently reads the referenced external files. The issue is addressed in versions 3.12.3 and 3.15.0.
Affected products
- Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
- 2026-06-26: patched: Initial patch release for 3.12.x branch
References
- https://github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c
- https://huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7
- https://github.com/keras-team/keras/commit/8f987f11bf7512f0df4774a8f1557bba07dc2b49
- https://github.com/keras-team/keras/releases/tag/v3.12.3
- https://github.com/keras-team/keras/releases/tag/v3.15.0