Arbitrary file reading is possible when Keras loads a .keras model file that references external datasets via the HDF5 format, allowing a remote attacker to read local files on the system where the model is loaded. This vulnerability stems from insufficient validation of the HDF5 external dataset references, exposing the application to both CWE-200 (information exposure) and CWE-73 (absolute path traversal). The flaw can result in the disclosure of sensitive configuration files, credentials, or source code, severely compromising confidentiality on the affected host.

Google Keras versions 3.0.0 through 3.13.1 on all supported platforms are affected. Any installation of Keras within these version ranges that uses the default HDF5 model loading mechanism is vulnerable, regardless of the underlying operating system.

The CVSS score for this vulnerability is 7.1, indicating a high severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector involves an attacker delivering a specially crafted .keras file to the target system—either through a file upload feature or by instrumenting a training or inference pipeline that consumes user-supplied models. Once executed, the vulnerability permits arbitrary local file reads but requires that the application load the malicious model file; no active network exploitation beyond file delivery is necessary.