Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| keras-team | keras-team/keras | up to latest | — | No fix listed | CNA |
| — | keras (PyPI) | before 3.12.3 | 3.12.3 | Patch available | GHSA-v2w2-w228-c444 |
| — | keras (PyPI) | 3.13.0 to before 3.15.0 | 3.15.0 | Patch available | GHSA-v2w2-w228-c444 |
- keras-team/keras Vendorkeras-team Affected up to latest Fixed in — No fix listed CNA
- keras (PyPI) Vendor— Affected before 3.12.3 Fixed in 3.12.3 Patch available GHSA-v2w2-w228-c444
- keras (PyPI) Vendor— Affected 3.13.0 to before 3.15.0 Fixed in 3.15.0 Patch available GHSA-v2w2-w228-c444
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* | — | — | keras-team |
- cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions — — ·keras-team
Remediation
- Fix · GHSA-v2w2-w228-c444 keras (PyPI) Fixed in 3.12.3 Advisory →
- Fix · GHSA-v2w2-w228-c444 keras (PyPI) Fixed in 3.15.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12484
- 2026-10-03 Alias added: GHSA-v2w2-w228-c444
References
Other 8
- https://huntr.com/bounties/ab14df49-13b5-4442-b754-3189430bfa28
- https://github.com/keras-team/keras/pull/23048
- https://github.com/keras-team/keras/pull/23165
- https://github.com/keras-team/keras/commit/55888d3becbdbb45dc16a55b489900f911e2dde5
- https://github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf
- https://github.com/keras-team/keras
- https://github.com/keras-team/keras/releases/tag/v3.12.3
- https://github.com/keras-team/keras/releases/tag/v3.15.0
More keras-team vulnerabilities
- TI-2025-31626 Deserialization of untrusted data in keras-team Keras CVSS 3.1CRITICAL 9.8
- TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
- TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
- TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
- TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
- TI-2025-11591 Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file() CVSS 3.0HIGH 8.0
Sources
- CVE-2026-12484 · CVE Program
- CVE-2026-12484 · NVD
- FIRST EPSS
- GHSA-v2w2-w228-c444 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-12484 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences