Keras: Lambda deserialization can bypass safe mode and execute code
Keras
More for Keras RSS feed for Keras
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-12481
- Affects
- Keras
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 3, 2026
- Source last modified
- October 25, 2026
Description
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is set to None, which is the default value when from_config() is called outside of a SafeModeScope context. This logic error conflates None (unset/default-deny) with False (explicitly disabled), bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include keras.layers.deserialize(config), keras.models.clone_model(model), and any direct invocation of Lambda.from_config(config) without an enclosing SafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.
Description quoted from the NVD record.
Who is affected
Keras is a toolkit that programmers use to build and run machine learning models (computer programs that learn from data). This flaw affects version 3.14.0. The problem is in the part of Keras that rebuilds a model's custom code building blocks. A safety check meant to stop untrusted code from loading does not work when its safety setting is left at its default, which happens in some common ways of loading or copying a model. An attacker who gets your system to load model settings they control could run any commands they want on the computer or server running Keras. This flaw is rated Critical.
What to do
- The person who installed or maintains the software that uses Keras (often a developer or data scientist) should handle this. If an IT provider or vendor runs it for your organization, send them this advisory and ask when the update will be done.
- Find out whether any of your computers or servers use Keras version
3.14.0. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- When a fixed release is available, install it on every computer or server that uses Keras.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.