CVE-2026-12484
published 2026-07-19CVE-2026-12484: A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public…
PriorityP343high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
0.20%
10.7th percentile
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keras-team | keras-team_keras | unspecified – latest | — |
| keras | keras | >= 0 < 3.12.3 | 3.12.3 |
| keras | keras | >= 3.13.0 < 3.15.0 | 3.15.0 |
| rhoai | odh-modelmesh-runtime-adapter-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
ghsa·2026-07-19
CVE-2026-12484 [HIGH] CWE-502 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe
VulDB
keras-team keras up to 3.15.0 TorchModuleWrapper TorchModuleWrapper.from_config deserialization
vuldb·2026-07-19·CVSS 7.8
CVE-2026-12484 [HIGH] keras-team keras up to 3.15.0 TorchModuleWrapper TorchModuleWrapper.from_config deserialization
A vulnerability labeled as critical has been found in keras-team keras up to 3.15.0. The impacted element is the function TorchModuleWrapper.from_config of the component TorchModuleWrapper. Executing a manipulation can lead to deserialization.
This vulnerability is registered as CVE-2026-12484. It is possible to launch the attack remotely. No exploit is available.
GHSA
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method.
ghsa_unreviewed·2026-07-19
CVE-2026-12484 [HIGH] CWE-502 A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method.
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Red Hat
keras: torch: Keras: Arbitrary code execution via unsafe deserialization of PyTorch data
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-12484 [HIGH] CWE-502 keras: torch: Keras: Arbitrary code execution via unsafe deserialization of PyTorch data
keras: torch: Keras: Arbitrary code execution via unsafe deserialization of PyTorch data
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly gu
No detection rules found.
No public exploits indexed.
2026-07-19
Published