Description
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Published: 2026-07-19
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from Keras version 3.15.0’s keras.layers.TorchModuleWrapper.from_config method, which calls torch.load(...) with weights_only set to False and without requiring an explicit safe‑mode opt‑in. When this method processes an attacker‑controlled PyTorch pickle payload, deserialization occurs by default, satisfying the conditions of CWE‑502 and allowing the execution of arbitrary code within the process that loads the layer.

Affected Systems

The affected product is Keras, released by the keras‑team, specifically version 3.15.0. No other releases are listed as impacted, indicating that only this exact release contains the unsafe deserialization path.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could remotely supply a crafted layer configuration to a Keras application that calls from_config outside a SafeModeScope context, leading to arbitrary code execution on the host that processes the configuration.

Generated by OpenCVE AI on August 1, 2026 at 07:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Keras to a release that enforces safe deserialization in TorchModuleWrapper.from_config, such as a patch that requires explicit safe mode or removes unsafe torch.load calls.
  • Wrap any calls to from_config for untrusted layer configurations inside a SafeModeScope(True) context to guarantee safe deserialization.
  • Validate or whitelist all layer configuration inputs to ensure only trusted, non‑picklable data is passed to the wrapper.

Generated by OpenCVE AI on August 1, 2026 at 07:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-v2w2-w228-c444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Keras-team
Keras-team keras
Vendors & Products Keras-team
Keras-team keras

Tue, 21 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 20 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 19 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Title Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config
Weaknesses CWE-502
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Keras-team Keras
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2026-07-20T13:45:55.809Z

Reserved: 2026-06-17T02:52:42.641Z

Link: CVE-2026-12484

cve-icon Vulnrichment

Updated: 2026-07-20T13:45:51.439Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-19T19:47:27Z

Links: CVE-2026-12484 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T07:30:13Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data