GHSA-26c4-7vv6-867j

Source

https://github.com/advisories/GHSA-26c4-7vv6-867j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-26c4-7vv6-867j/GHSA-26c4-7vv6-867j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-26c4-7vv6-867j

Aliases

Downstream

MINI-53c4-pr5f-8h8m

Published

2026-07-01T18:31:51Z

Modified

2026-08-10T11:40:53Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Keras: HDF5 virtual datasets can disclose local files

Details

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.

Database specific

{
    "cwe_ids":  [
        "CWE-73"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T20:28:58Z",
    "nvd_published_at":  "2026-07-01T17:16:19Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / keras

Package

Name: keras; View open source insights on deps.dev
Purl: pkg:pypi/keras

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.12.3

Affected versions

0.*

0.2.0

0.3.0

0.3.1

0.3.2

0.3.3

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.1.0

1.1.1

1.1.2

1.2.0

1.2.1

1.2.2

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.3.1

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0rc0

2.6.0rc0

2.6.0rc1

2.6.0rc2

2.6.0rc3

2.6.0

2.7.0rc0

2.7.0rc2

2.7.0

2.8.0rc0

2.8.0rc1

2.8.0

2.9.0rc0

2.9.0rc1

2.9.0rc2

2.9.0

2.10.0rc0

2.10.0rc1

2.10.0

2.11.0rc0

2.11.0rc1

2.11.0rc2

2.11.0rc3

2.11.0

2.12.0rc0

2.12.0rc1

2.12.0

2.13.1rc0

2.13.1rc1

2.13.1

2.14.0rc0

2.14.0

2.15.0rc0

2.15.0rc1

2.15.0

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0

3.1.1

3.2.0

3.2.1

3.3.0

3.3.1

3.3.2

3.3.3

3.4.0

3.4.1

3.5.0

3.6.0

3.7.0

3.8.0

3.9.0

3.9.1

3.9.2

3.10.0

3.11.0

3.11.1

3.11.2

3.11.3

3.12.0

3.12.1

3.12.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-26c4-7vv6-867j/GHSA-26c4-7vv6-867j.json"

PyPI / keras

Package

Name: keras; View open source insights on deps.dev
Purl: pkg:pypi/keras

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.13.0

Fixed

3.15.0

Affected versions

3.*

3.13.0

3.13.1

3.13.2

3.14.0

3.14.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-26c4-7vv6-867j/GHSA-26c4-7vv6-867j.json"