Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
Keras
More for Keras RSS feed for Keras
- Severity
- High, CVSS 7.8
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-12484
- Affects
- Keras
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 19, 2026
- Source last modified
- August 7, 2026
Description
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.from_config method. This method invokes torch.load(..., weights_only=False) without requiring an explicit unsafe opt-in, such as a safe_mode=False parameter. When called outside a SafeModeScope(True) context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.
Description quoted from the NVD record.
Who is affected
Keras is a tool that programmers use to build and run artificial intelligence (machine learning) models. This flaw affects version 3.15.0, in the feature that lets Keras use model parts built with PyTorch, another machine learning tool. If someone using Keras loads model settings from an untrusted source through this feature, and Keras's built-in safe mode is not switched on at that moment, an attacker who crafted those settings could run any commands they choose on that computer. This flaw is rated High.
What to do
- Ask whoever builds or runs your organization's AI or data projects (staff, a contractor, or your IT provider) whether they use Keras version
3.15.0. - If they do, the person who installed or runs Keras should update it once a fix is out. No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- If an IT provider or vendor manages these projects for you, send them this advisory and ask when the update will be done.
- In the meantime, ask them whether their work loads Keras model settings from outside sources, because this flaw matters when settings from an untrusted source are loaded.
Analysis written from the source record as of August 7, 2026 and reviewed before publishing.