A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`

Overview

A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the from_config() method.

Affected

• keras = 3.13.0
• openshift_ai >= 2.25, < 2.25.7

Remediation

Upgrade past the affected range:

• openshift_ai 2.25.7

Package advisory (CVE-2026-1462)

Affected packages:

• keras < 3.13.2

Patched in:

• keras 3.13.2

Source: https://osv.dev/vulnerability/GHSA-4f3f-g24h-fr8m