Keras versions up to and including 3.13.2 contain a flaw that allows an attacker to read files on the victim’s system through a crafted HDF5 file. The vulnerability lies in the lack of a check for the dataset.is_virtual flag inside H5IOStore._verify_dataset() and file_editor.py. By placing a Virtual Dataset that points to an external HDF5 file within a .keras or .h5 archive, an attacker can cause the Keras loader to read that external file without validation, leading to disclosure of data that should remain confidential. This problem is a classic instance of CWE‑73: External Control of File Name or Path and also involves CWE‑22: Path Traversal, but does not provide code execution or privilege escalation, only data leakage.

The affected product is Keras from keras-team. All releases from 3.12.0 up to and including 3.13.2 are vulnerable. The vulnerability was fixed in releases 3.12.2 and 3.14.1, and any later version incorporates the fix. Versions beyond 3.14.1 are not affected.

The CVSS score of 5.5 indicates moderate risk, while the EPSS score of <1% reflects a low probability of exploitation. The flaw is not listed in CISA KEV, and there is no public evidence of active exploitation. The attack vector is inferred to be the delivery of a malicious model file that contains a virtual dataset referencing a local HDF5 file; the file must then be loaded by an application using keras.models.load_model() or keras.saving.load_model(). Because the vulnerability requires the victim to load a crafted file, the exposure is limited to scenarios where untrusted model files are accepted, such as through local uploads or remote distribution.