The flaw in the TFSMLayer class of the Keras package allows an attacker to load TensorFlow SavedModels that are fully under the attacker's control when a .keras model is deserialized, even when safe_mode=True. This bypasses the intended safety checks and permits arbitrary code execution during model inference, executing in the context of the victim’s process.

The vulnerability is present only in the keras package maintained by the keras-team, specifically version 3.13.0. No other vendors or product versions are listed as affected in the CNA data.

The CVSS score of 7.8 indicates a high severity. The lack of EPSS data prevents a precise estimate of exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a malicious .keras file that the victim loads, which can occur if the victim accepts untrusted models from external sources or a compromised model repository. When exploited, the attacker can execute arbitrary code at the privileges of the inference process.