CVE-2026-12484High· 7.8▾ TwilightKeras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.4%
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from_config method. This method invokes torch.load(..., weights_only=False) without requiring an explicit unsafe opt-in, such as a safe_mode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
keras < 3.12.3keras >= 3.13.0, < 3.15.0Upgrade to a patched release:
keras 3.12.3keras 3.15.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12479Medium· 6.1Keras: DiskIOStore permits path traversal through crafted layer names
CVE-2026-12482Low· 3.1Keras: tar extraction permits symlink-based path traversal
CVE-2026-12480Medium· 5.5Keras: HDF5 virtual datasets can disclose local files
CVE-2026-12570Medium· 5.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function
CVE-2024-55459Mediumkeras Path Traversal vulnerability
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality