Vulnerabilities for keras

First version without a known vulnerability: 3.15.0

Details

• GHSA-m8wh-29wm-52mv2026-08-02

  Keras: HDF5 links can disclose local file contents

  Fixed in: 3.12.3, 3.15.0

• GHSA-v2w2-w228-c4442026-07-19

  Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

  Fixed in: 3.12.3, 3.15.0

• GHSA-58hv-7753-xmfq2026-07-14

  Keras: tar extraction permits symlink-based path traversal

  Fixed in: 3.12.3, 3.15.0

• GHSA-5gwj-m78q-7pq32026-07-03

  Keras: Lambda deserialization can bypass safe mode and execute code

  Fixed in: 3.12.3, 3.15.0

• GHSA-26c4-7vv6-867j2026-07-01

  Keras: HDF5 virtual datasets can disclose local files

  Fixed in: 3.12.3, 3.15.0

• GHSA-gh82-f9x8-5frx2026-06-22

  Keras: DiskIOStore permits path traversal through crafted layer names

  Fixed in: 3.12.3, 3.15.0

• GHSA-hqp4-2352-xf5r2026-06-11

  Keras archive extraction utilities allow path traversal and arbitrary file writes

  Fixed in: 3.14.0

• GHSA-mgx6-5cf9-rr432026-05-06

  Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

  Fixed in: 3.12.1, 3.13.2, 3.13.1

• GHSA-4f3f-g24h-fr8m2026-04-13

  Keras has an untrusted deserialization vulnerability

  Fixed in: 3.13.2

• GHSA-3m4q-jmj6-r34q2026-02-18

  Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading

  Fixed in: 3.13.2, 3.12.1

• GHSA-hjqc-jx6g-rwp92025-12-02

  Keras Directory Traversal Vulnerability

  Fixed in: 3.12.0

• GHSA-mq84-hjqx-cwf22025-10-29

  Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

  Fixed in: 3.12.0

• GHSA-cvhh-q5g5-qprp2025-10-17

  Keras framework vulnerable to deserialization of untrusted data

  Fixed in: 3.11.3

• GHSA-36rr-ww3j-vrjv2025-09-19

  The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

  Fixed in: 3.11.3

• GHSA-36fq-jgmw-4r9c2025-09-19

  Keras is vulnerable to Deserialization of Untrusted Data

  Fixed in: 3.11.0

• GHSA-c9rc-mg46-23w32025-08-12

  Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality

  Fixed in: 3.11.0

• GHSA-48g7-3x6r-xfhp2025-03-11

  Arbitrary Code Execution via Crafted Keras Config for Model Loading

  Fixed in: 3.9.0, 3.8.0

• GHSA-cjgq-5qmw-rcj62025-01-08

  keras Path Traversal vulnerability

• GHSA-x4wf-678h-2pmq2024-04-16

  Keras code injection vulnerability

  Fixed in: 2.13.1rc0