Keras (`TorchModuleWrapper`): Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras model

Impact

Unsafe deserialization of attacker-controlled PyTorch pickle inside a Keras model

Who can reach it

Customer-supplied model file

What to do

Upgrade past 3.15.0; cross-framework pickle re-entry defeats Keras' own safe mode

References

Related entries

• timm: untrusted checkpoint deserialization executes arbitrary code in the loading processCVE-2026-15679 · Hugging Face pytorch-image-models (timm) checkpoint loadingHigh
• HuggingFace transformers (`Trainer._load_rng_state`): Arbitrary code execution when a training run resumesCVE-2026-1839 · HuggingFace transformers (`Trainer._load_rng_state`)High
• NVIDIA NeMo Speech: malicious input data leads to remote code executionCVE-2026-24239 · NVIDIA NeMo SpeechHigh
• NVIDIA NeMo Speech: RCE and privilege escalation in the speech data explorerCVE-2026-24267 · NVIDIA NeMo Speech (speech data explorer)High
• BentoML (`safe_extract_tarfile`): Tar extraction escape despite the "safe" helperCVE-2026-27905 · BentoML (`safe_extract_tarfile`)High
• llama.cpp (`ggml_nbytes`): Integer overflow in the core ggml size calculationCVE-2026-33298 · llama.cpp (`ggml_nbytes`)High