Keras versions up to and including 3.13.2 can be abused by an attacker who crafts a malicious .keras or .h5 archive containing a Virtual Dataset that points to an external HDF5 file on the victim's filesystem. When the victim loads the model, the loader reads the external file without validating the path or checking the dataset's virtual flag, exposing data that should remain private. The flaw is a classic case of CWE‑73 External Control of File Name or Path and also falls under CWE‑22 Path Traversal; it does not enable code execution or privilege escalation.

The vulnerable product is Keras provided by keras-team. Releases up to and including 3.13.2 are affected, and the issue is addressed in version 3.12.2 and again in 3.14.1 and later releases.

The CVSS score of 5.5 indicates a moderate risk and the EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and there is no evidence of active exploitation. The attack vector is inferred to involve delivering a malicious model file that contains a Virtual Dataset reference and then having the victim load that file using keras.models.load_model() or keras.saving.load_model(). Because the flaw requires the victim to load an attacker‑crafted file, exposure is limited to scenarios where untrusted .keras or .h5 files are accepted, such as local uploads or remote model distribution.