Skip to content
Fencer Vulns
high 8.8

CVE-2026-12481 json

Deserialization of Untrusted Data in keras-team/keras

published 2026-07-03 4 mo ago modified 2026-10-25 14 d ago also GHSA-5gwj-m78q-7pq3 , PYSEC-2026-3631 , EUVD-2026-41600

cvss
8.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

Patch / fix

  • pypi keras 3.12.3, 3.15.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12481 updated cvss 8.8

keras: Keras: Arbitrary code execution via deserialization vulnerability

  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-runtime-adapter-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift AI 3.4 rhoai/odh-kserve-storage-initializer-rhel9 1787073479
    fixed: vendor fix RHSA-2026:60520
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9, +1 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1787330837, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-mlflow-rhel9 1787226790, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-trainer-rhel9 1787089049, +99 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi keras
<3.12.3
>=3.13.0, <3.15.0
3.12.3
3.15.0

Affected products

  • keras-team keras-team/keras

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.