CVE-2026-12480Medium· 5.5▾ SunlitKeras: HDF5 virtual datasets can disclose local files
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.1%
0.1% → 0.2%
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.
keras < 3.12.3keras >= 3.13.0, < 3.15.0Upgrade to a patched release:
keras 3.12.3keras 3.15.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12484High· 7.8Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
CVE-2026-12479Medium· 6.1Keras: DiskIOStore permits path traversal through crafted layer names
CVE-2026-12482Low· 3.1Keras: tar extraction permits symlink-based path traversal
CVE-2026-12570Medium· 5.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function
CVE-2024-55459Mediumkeras Path Traversal vulnerability
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality