← Vulnerability feed

Vulnerability record · CVE-2026-12481 · published 3 July 2026

CVE-2026-12481: Keras deserialization of untrusted data vulnerability

Keras · Keras

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

9.8 CVSS 3.1 Critical EPSS 0.72% · top 48.0% CWE-502 · Deserialization of untrusted data
9.8CVSS 3.1 base score
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
8 Jul 2026Last modified by NVD

Description

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d ExploitThird Party Advisory
https://huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d ExploitThird Party Advisory

Track CVE-2026-12481 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-3660Keras code injection vulnerabilityA arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions…EPSS 1.7%8.6CVE-2025-9906Keras deserialization of untrusted data vulnerabilityThe Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted …EPSS 0.20%8.6CVE-2025-8747Keras deserialization of untrusted data vulnerabilityA safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code…EPSS 0.12%8.1CVE-2026-11816Keras path traversal vulnerabilityKeras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py…EPSS 0.56%7.8CVE-2026-1462Keras deserialization of untrusted data vulnerabilityA vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded durin…EPSS 0.40%7.3CVE-2025-9905Keras improper control of dynamically-managed code vulnerabilityThe Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted …EPSS 0.22%7.3CVE-2025-1550Keras code injection vulnerabilityThe Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras arch…EPSS 2.6%7.1CVE-2026-1669Keras information exposure vulnerabilityArbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remo…EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2026-12481), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.