Offensive Testing
Penetration TestingVulnerability AssessmentsRed Team Engagements
Advisory & Research
AI Launch Risk ReviewSecurity Architecture ReviewSecurity ResearchSecurity Awareness Training
Software
Breachwright
Community
AI Security DatabaseAdvent Prompt PwnField Manual
ResearchAboutContact
Get in Touch
← Back to the database
medium · 5.5Maintainer reviewedAASD-2025-0008

Keras safe-mode model loading permits local file reads and conditional SSRF

Keras versions before 3.12.0 could resolve attacker-controlled vocabulary paths from StringLookup or IntegerLookup layers while loading a crafted `.keras` archive, even with safe mode enabled. The resulting deserialization side effect could read local files and, when compatible TensorFlow filesystem handlers were installed, request internal or external network resources.

Prerequisites

  • A user, model-ingestion worker, or application loads an attacker-controlled .keras archive
  • Network access additionally requires a TensorFlow filesystem handler that supports the supplied remote scheme

Potential impact

  • Reading local files into the reconstructed lookup-layer vocabulary
  • Server-side requests to internal or external resources when a compatible remote filesystem handler is available
  • Persistence of sensitive vocabulary content if the loaded model is saved or redistributed

Mitigations

  • Upgrade Keras to version 3.12.0 or later
  • Treat all third-party model artifacts as untrusted and inspect or sandbox them before loading
  • Deny unnecessary outbound network access and filesystem access from model-ingestion workers
  • Do not rely on safe mode as the only control for untrusted model deserialization

Public sources

vendor advisorycve recordpatch

Research note

Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-28.