Keras: malicious .keras/.h5 weights file reads arbitrary local files via HDF5 ExternalLinks

CVE-2026-9335AI/ML frameworks & servingcurated

Impact

Keras <= 3.14.0 dereferences HDF5 ExternalLinks when loading weights, so a model file supplied by someone else can pull in the contents of arbitrary files on the machine doing the load. The safe_get_h5_group/safe_get_h5_dataset helpers that reject ExternalLinks and SoftLinks are bypassed on these two paths. On a shared GPU fleet the loading process is usually a training job or a model-conversion step running with the tenant's or the platform's service credentials, so the disclosed content can include tokens, kubeconfigs, or another job's checkpoint data mounted into the same container. It is a read primitive only - no code execution is claimed in this record - and it requires the victim to load the attacker's file (UI:R).

Who can reach it

Anyone who can get a crafted .h5, .weights.h5 or .keras file loaded by a victim - a model pushed to a shared registry or artifact bucket, a fine-tune submitted to a training service, or a hub download. No authentication to the target; user interaction (the load) is required.

What to do

Upgrade Keras past 3.14.0 to a release containing commit 23370f1, which routes these paths through the safe link-checking helpers, and restart any serving or training workers that have the old version imported. No configuration workaround is documented; until upgraded, treat model files from untrusted sources as executable input and load them in a sandbox with no credentials mounted.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-9335 https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.