Junglewise Threat Intelligence

CVE-2026-12481: Keras Team Keras arbitrary code execution in Lambda layer

CVE-2026-12481 · Severity: high · CVSS 8.8 · Published 2026-07-03

Technologies: keras (PyPI). Vendors: PyPI.

Executive brief

Keras, a popular machine learning library, contains a vulnerability that could allow an attacker to execute malicious code on a user's system. The issue exists in how the library handles certain model components (Lambda layers) during the loading process, failing to properly enforce security restrictions. If a user is tricked into loading a specially crafted malicious model file, an attacker could gain full control over the underlying server or workstation.

Technical details

A logic error in the `_raise_for_lambda_deserialization()` function and `TorchModuleWrapper.from_config()` fails to enforce safe-mode guards when `safe_mode` is set to `None` (the default state outside of a `SafeModeScope`). The library conflates this `None` value with `False`, allowing the deserialization of attacker-controlled `marshal` bytecode or `torch.load()` pickles. Attackers can exploit this by providing a malicious configuration to call sites such as `keras.layers.deserialize()`, `keras.models.clone_model()`, or direct `Lambda.from_config()` calls. Successful exploitation results in arbitrary OS-level code execution in the context of the process. The issue is patched in versions 3.12.3 and 3.15.0 by ensuring the library fails closed when safe mode is unset.

Affected products

  • Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0

Timeline

  • 2026-06-06: patched: Initial fix submitted via PR 23048
  • 2026-07-03: disclosed: Vulnerability disclosed and CVE-2026-12481 assigned
  • 2026-07-03: advisory: GitHub Advisory published

References

Related threats