CVE-2026-12484 in keras
Summary
by MITRE • 07/19/2026
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the keras-team/keras framework at version 3.15.0 and represents a critical security flaw in the TorchModuleWrapper.from_config method that enables unsafe deserialization of PyTorch pickle data. The issue stems from the method's default behavior of invoking torch.load with weights_only=False parameter without requiring explicit unsafe opt-in mechanisms, creating a dangerous attack surface where untrusted configuration data can trigger arbitrary code execution. The vulnerability specifically manifests when the method processes attacker-controlled Keras layer configurations that contain malicious PyTorch pickle data, allowing remote attackers to execute arbitrary code on systems running vulnerable versions of the framework.
The technical root cause lies in the method's failure to enforce safe deserialization practices by default, relying instead on ambient safe mode state that may not be properly configured. When the from_config method is called outside of a SafeModeScope(True) context, it operates under default settings that permit unsafe deserialization operations. This design flaw violates fundamental security principles and creates an environment where malicious actors can exploit the lack of explicit safety checks to inject and execute arbitrary code through carefully crafted pickle data structures. The vulnerability directly maps to CWE-502 which describes unsafe deserialization of untrusted data, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter execution.
The operational impact of this vulnerability is severe as it allows attackers to perform arbitrary code execution on systems processing untrusted Keras configurations, potentially leading to complete system compromise. Attackers can craft malicious layer configurations that contain malicious PyTorch pickle data, which when processed through the vulnerable from_config method will execute code on the target system with the privileges of the running process. This creates a significant risk for applications that process configuration data from untrusted sources, including web applications, data processing pipelines, and machine learning model deployment systems. The vulnerability affects any environment where Keras models are loaded from potentially malicious sources without proper validation or safe mode enforcement.
Mitigation strategies should prioritize immediate implementation of explicit safe mode enforcement through SafeModeScope(True) contexts when processing untrusted configurations. Organizations should update to patched versions of keras-team/keras where the default behavior has been changed to require explicit unsafe mode opt-in for pickle deserialization operations. Additionally, input validation and sanitization should be implemented at multiple layers to prevent malicious data from reaching vulnerable methods, including schema validation of configuration files and runtime monitoring for suspicious deserialization patterns. Security teams should also implement network segmentation and access controls to limit the potential impact of successful exploitation, while maintaining regular security assessments to identify similar vulnerabilities in other components that may handle untrusted serialized data.