PYSEC-2026-3634

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/keras/PYSEC-2026-3634.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3634
Aliases
Published
2026-08-10T10:43:49.248554Z
Modified
2026-08-10T11:30:12.983398006Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Details

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from_config method. This method invokes torch.load(..., weights_only=False) without requiring an explicit unsafe opt-in, such as a safe_mode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.

References

Affected packages

PyPI / keras

Package

Name
keras
View open source insights on deps.dev
Purl
pkg:pypi/keras

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.12.3
Introduced
3.13.0
Fixed
3.15.0

Affected versions

0.*
0.2.0
0.3.0
0.3.1
0.3.2
0.3.3
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0rc0
2.6.0rc0
2.6.0rc1
2.6.0rc2
2.6.0rc3
2.6.0
2.7.0rc0
2.7.0rc2
2.7.0
2.8.0rc0
2.8.0rc1
2.8.0
2.9.0rc0
2.9.0rc1
2.9.0rc2
2.9.0
2.10.0rc0
2.10.0rc1
2.10.0
2.11.0rc0
2.11.0rc1
2.11.0rc2
2.11.0rc3
2.11.0
2.12.0rc0
2.12.0rc1
2.12.0
2.13.1rc0
2.13.1rc1
2.13.1
2.14.0rc0
2.14.0
2.15.0rc0
2.15.0rc1
2.15.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.13.2
3.14.0
3.14.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/keras/PYSEC-2026-3634.yaml"