CVE-2021-37678
published 2021-08-12CVE-2021-37678: TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code…
PriorityP345high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.45%
36.4th percentile
TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input. Given that YAML format support requires a significant amount of work, we have removed it for now. We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | — | — | |
| tensorflow | — | — | |
| tensorflow | >= 2.3.0 < 2.3.4 | 2.3.4 | |
| tensorflow | >= 2.4.0 < 2.4.3 | 2.4.3 | |
| intel | optimization_for_tensorflow | >= 0 < 2.3.4 | 2.3.4 |
| intel | optimization_for_tensorflow | >= 0 < 23d6383eb6c14084a8fc3bdf164043b974818012 | 23d6383eb6c14084a8fc3bdf164043b974818012 |
| intel | optimization_for_tensorflow | >= 2.3.0 < 2.3.4 | 2.3.4 |
| intel | optimization_for_tensorflow | >= 2.4.0 < 2.4.3 | 2.4.3 |
| intel | optimization_for_tensorflow | >= 2.5.0 < 2.5.1 | 2.5.1 |
| tensorflow | tensorflow | < 2.3.4 | 2.3.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_debian9.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Arbitrary code execution due to YAML deserialization
ghsa·2021-08-25
CVE-2021-37678 [HIGH] CWE-502 Arbitrary code execution due to YAML deserialization
Arbitrary code execution due to YAML deserialization
### Impact
TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.
```python
from tensorflow.keras import models
payload = '''
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
'''
models.model_from_yaml(payload)
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input.
### Patches
Given that YAML format support requires a significant amount of work, we have removed it for now.
We ha
OSV
Arbitrary code execution due to YAML deserialization
osv·2021-08-25
CVE-2021-37678 [HIGH] Arbitrary code execution due to YAML deserialization
Arbitrary code execution due to YAML deserialization
### Impact
TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.
```python
from tensorflow.keras import models
payload = '''
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
'''
models.model_from_yaml(payload)
```
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input.
### Patches
Given that YAML format support requires a significant amount of work, we have removed it for now.
We ha
OSV
CVE-2021-37678: TensorFlow is an end-to-end open source platform for machine learning
osv·2021-08-12
CVE-2021-37678 CVE-2021-37678: TensorFlow is an end-to-end open source platform for machine learning
TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input. Given that YAML format support requires a significant amount of work, we have removed it for now. We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
Debian
CVE-2021-37678: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect...
vendor_debian·2021·CVSS 9.3
CVE-2021-37678 [CRITICAL] CVE-2021-37678: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. In affect...
TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input. Given that YAML format support requires a significant amount of work, we have removed it for now. We have patched the issue in GitHub commit 23d6383eb6c14084a8fc3bdf164043b974818012. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are
No detection rules found.
No public exploits indexed.
arXiv
On the (In)Security of Loading Machine Learning Models
arxiv_fulltext·2026-03-12
On the (In)Security of Loading Machine Learning Models
On the (In)Security of Loading Machine Learning Models
Gabriele Digregorio,
Marco Di Gennaro,
Stefano Zanero,
Stefano Longari,
Michele Carminati
Politecnico di Milano
Milan, Italy
\gabriele.digregorio, marco.digennaro, stefano.zanero, stefano.longari, michele.carminati\@polimi.it
firstpagestyle
## Abstract
The rise of model sharing through frameworks and dedicated hubs makes ML significantly more accessible.
Despite its benefits, loading shared models exposes users to underexplored security risks, while security awareness remains limited among both practitioners and developers.
To enable a more security-conscious approach in ML model sharing, in this paper, we evaluate the security posture of frameworks and hubs, assess whether security-oriented mechanisms offer real protection, and
arXiv
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
arxiv_fulltext·2026-03-02
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
## Abstract
Large language models (LLMs) are increasingly being deployed as software engineering agents that autonomously contribute to repositories. A major benefit these agents present is their ability to find and patch security vulnerabilities in the codebases they oversee. To estimate the capability of agents in this domain, we introduce ZeroDayBench, a benchmark where LLM agents find and patch 22 novel critical vulnerabilities in open-source codebases. We focus our efforts on three popular frontier agentic LLMs: GPT-5.2, Claude Sonnet 4.5, and Grok 4.1. We find that frontier LLMs are not yet capable of autonomously solving our tasks and observe some behavioral patterns that suggest how these models can be improved in the domain of proactive cyberdefense.
## Introduction
Large langu
arXiv
Threat Assessment in Machine Learning based Systems
arxiv_fulltext·2022-06-30
Threat Assessment in Machine Learning based Systems
Threat Assessment in Machine Learning based Systems
Lionel Nganyewou Tidjon and Foutse Khomh, Senior Member, IEEE
The authors are with Polytechnique Montréal, Montréal, QC H3C 3A7, Canada.
E-mail: \lionel.tidjon, foutse.khomh\@polymtl.ca
## Abstract
Machine learning is a field of artificial intelligence (AI) that is becoming essential for several critical systems, making it a good target for threat actors. Threat actors exploit different Tactics, Techniques, and Procedures (TTPs) against the confidentiality, integrity, and availability of Machine Learning (ML) systems.
During the ML
cycle, they exploit adversarial TTPs to poison data and fool ML-based systems. In recent years, multiple security practices have been proposed for traditional systems but they are not enough to cope with th
https://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012https://github.com/tensorflow/tensorflow/security/advisories/GHSA-r6jx-9g48-2r5rhttps://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012https://github.com/tensorflow/tensorflow/security/advisories/GHSA-r6jx-9g48-2r5r
2021-08-12
Published