CVE-2026-1462 PUBLISHED

Safe Mode Bypass in keras-team/keras

Assigner: @huntr_ai
Reserved: 27.01.2026 Published: 13.04.2026 Updated: 13.04.2026

A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the from_config() method.

Metrics

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor keras-team
Product keras-team/keras
Versions
  • affected from unspecified to 3.13.2 (excl.)

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE