GHSA-5gwj-m78q-7pq3

Suggest an improvement
Source
https://github.com/advisories/GHSA-5gwj-m78q-7pq3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gwj-m78q-7pq3/GHSA-5gwj-m78q-7pq3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5gwj-m78q-7pq3
Aliases
Downstream
Published
2026-07-03T21:31:36Z
Modified
2026-08-10T11:40:41Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Keras: Lambda deserialization can bypass safe mode and execute code
Details

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is set to None, which is the default value when from_config() is called outside of a SafeModeScope context. This logic error conflates None (unset/default-deny) with False (explicitly disabled), bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include keras.layers.deserialize(config), keras.models.clone_model(model), and any direct invocation of Lambda.from_config(config) without an enclosing SafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

Database specific 
{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T20:30:41Z",
    "nvd_published_at":  "2026-07-03T21:16:54Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / keras

Package

Name
keras
View open source insights on deps.dev
Purl
pkg:pypi/keras

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.12.3

Affected versions

0.*
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0rc0
2.6.0rc0
2.6.0rc1
2.6.0rc2
2.6.0rc3
2.6.0
2.7.0rc0
2.7.0rc2
2.7.0
2.8.0rc0
2.8.0rc1
2.8.0
2.9.0rc0
2.9.0rc1
2.9.0rc2
2.9.0
2.10.0rc0
2.10.0rc1
2.10.0
2.11.0rc0
2.11.0rc1
2.11.0rc2
2.11.0rc3
2.11.0
2.12.0rc0
2.12.0rc1
2.12.0
2.13.1rc0
2.13.1rc1
2.13.1
2.14.0rc0
2.14.0
2.15.0rc0
2.15.0rc1
2.15.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
3.12.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gwj-m78q-7pq3/GHSA-5gwj-m78q-7pq3.json"

PyPI / keras

Package

Name
keras
View open source insights on deps.dev
Purl
pkg:pypi/keras

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.13.0
Fixed
3.15.0

Affected versions

3.*
3.13.0
3.13.1
3.13.2
3.14.0
3.14.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gwj-m78q-7pq3/GHSA-5gwj-m78q-7pq3.json"