Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config

published 2026-07-19 3 mo ago modified 2026-10-24 15 d ago also GHSA-v2w2-w228-c444 , PYSEC-2026-3634 , EUVD-2026-45872

cvss: 7.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.

Patch / fix

fixed in 1 links 6

pypi keras 3.12.3, 3.15.0

github.com/keras-team/keras@55888d3 commit
github.com/keras-team/keras@d338a45 commit
github.com/keras-team/keras#23048 pull request
github.com/keras-team/keras#23165 pull request
github.com/keras-team/keras/releases/tag/v3.12.3 release
github.com/keras-team/keras/releases/tag/v3.15.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12484 updated 2026-09-01 cvss 7.8

keras: torch: Keras: Arbitrary code execution via unsafe deserialization of PyTorch data

Red Hat OpenShift AI (RHOAI) rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
affected: workaround, no fix available
Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-modelmesh-runtime-adapter-rhel9, rhoai/odh-kserve-storage-initializer-rhel9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-20)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	keras	<3.12.3 >=3.13.0, <3.15.0	3.12.3 3.15.0

Affected products

keras-team keras-team/keras

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary