Executive brief
Keras, a popular deep learning library, contains a vulnerability in how it handles certain PyTorch-based model layers. If a user is tricked into loading a specially crafted, untrusted model configuration file, an attacker could execute arbitrary code on the user's system. This occurs because the software fails to enforce security restrictions by default when processing these specific model components.
Technical details
A deserialization vulnerability exists in `keras.layers.TorchModuleWrapper.from_config` due to the unsafe use of `torch.load(..., weights_only=False)`. The root cause is a "fail-open" logic where the method does not enforce Keras's internal `safe_mode` unless explicitly wrapped in a `SafeModeScope(True)` or provided with a `safe_mode=False` parameter. An attacker can provide a malicious Keras layer configuration containing a PyTorch pickle payload; when deserialized, this payload can execute arbitrary Python code. The issue was addressed by changing the default behavior to "fail-closed," requiring explicit opt-in for unsafe deserialization. Fixes are available in versions 3.12.3 and 3.15.0.
Affected products
- Keras Team Keras < 3.12.3, >= 3.13.0, < 3.15.0
Timeline
- 2026-06-06: patched: Initial fix submitted via PR 23048
- 2026-07-19: advisory: GitHub Advisory and NVD record published
- 2026-08-07: other: Advisory reviewed and updated by GitHub staff
References
- https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28
- https://github.com/keras-team/keras/pull/23048
- https://github.com/keras-team/keras/pull/23165
- https://github.com/keras-team/keras/commit/55888d3becbdbb45dc16a55b489900f911e2dde5
- https://github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf