CVE-2026-12481

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is set to None, which is the default value when from_config() is called outside of a SafeModeScope context. This logic error conflates None (unset/default-deny) with False (explicitly disabled), bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include keras.layers.deserialize(config), keras.models.clone_model(model), and any direct invocation of Lambda.from_config(config) without an enclosing SafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12481.json"
}

References

Affected packages

Git / github.com/keras-team/keras

Affected ranges

Type

GIT

Repo

https://github.com/keras-team/keras

Events

Introduced

050671c8cfa58cd288bcc1f4ad21e83991bfdf9f

Last affected

050671c8cfa58cd288bcc1f4ad21e83991bfdf9f

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.14.0"
        },
        {
            "last_affected": "3.14.0"
        }
    ],
    "cpe": "cpe:2.3:a:keras:keras:3.14.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

3.*

3.14.0

v3.*

v3.14.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12481.json"