CVE-2026-9335

Improper Handling of HDF5 ExternalLinks in keras-team/keras

Published Aug 2, 2026 CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.

Analysis

Technical impact

The vulnerability resides in Keras team releases through version 3.14.0, where the KerasFileEditor and keras.saving.load_weights functions bypass safety checks that are meant to reject HDF5 ExternalLinks and SoftLinks. This improper handling leads to automatic dereferencing of links to external HDF5 files, which means that a maliciously crafted .h5, .weights.h5, or .keras file can expose any local files that the process can read. The primary impact is disclosure of sensitive data from the victim's local filesystem rather than remote code execution or denial of service.

Affected Systems

Keras versions 3.14.0 and earlier, across any operating system that employs the KerasFileEditor or load_weights routines to load user‑supplied HDF5 model or weight files.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is listed as less than 1%, suggesting an extremely low likelihood of exploitation in the wild. It is not presently catalogued in the CISA KEV. Attackers would need the ability to supply a malicious HDF5 file to the Keras application, either via a file upload or by directing the program to load a specific file path. Once present, the vulnerability allows local disclosure of any files that the executing user has access to, but does not provide a remote code execution path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

keras-team

keras-team/keras

affected

Version	Status	Constraints
`unspecified`	affected	< 3.12.3, 3.15.0

No data.

Vendor Product Versions

Keras-team

Keras

Version	Status	Scheme	Platform
`[0,3.12.3)`	affected	semver	—
`[0,3.15.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Keras to version 3.15 or newer to eliminate the vulnerable code paths.
Modify any custom loading logic to use the safe_get_h5_group and safe_get_h5_dataset helpers or otherwise reject HDF5 ExternalLinks before extraction.
Implement strict validation of any HDF5 files received from external sources, ensuring they contain no ExternalLinks and are accessed only with the minimal file system permissions required for the Keras process.

Generated by OpenCVE AI on August 3, 2026 at 09:29 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-m8wh-29wm-52mv	Keras: HDF5 links can disclose local file contents

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.767% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e
https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5

History

Aug 3, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Keras-team Keras-team keras
Vendors & Products		Keras-team Keras-team keras

Aug 2, 2026 5:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
Title		Improper Handling of HDF5 ExternalLinks in keras-team/keras
Weaknesses		CWE-22
References		https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5
Metrics		cvssV3_0 `{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`