Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keras | pip | < 3.12.3 | 3.12.3 |
| keras | pip | >= 3.13.0, < 3.15.0 | 3.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the improper handling of HDF5 files that contain ExternalLink or SoftLink objects. The Keras library, in versions prior to the patch, did not adequately validate the structure of HDF5 files when loading model weights or editing Keras files. Two key functions were identified as vulnerable:
KerasFileEditor._extract_weights_from_store: This internal function, called by the KerasFileEditor constructor, recursively traversed HDF5 files. It used direct dictionary-style key access (e.g., data[key]) to read groups and datasets. The h5py library, by default, follows HDF5 links during such access. This allowed an attacker to craft a malicious .h5 or .keras file with a link pointing to a sensitive local HDF5 file. When a user or automated process opened this file with KerasFileEditor, the editor would read the contents of the linked file, making them accessible to the attacker.
keras.saving.load_weights: This public API function had a similar flaw when handling legacy .h5 weight files. It directly accessed the model_weights group within the HDF5 file (f["model_weights"]). Just like with KerasFileEditor, this would cause h5py to follow any external or soft links, allowing an attacker to load weights from an arbitrary HDF5 file on the filesystem into the user's model.
The patches for both functions replace the unsafe direct access with calls to a secure helper function, saving_lib.safe_get_h5_group, which explicitly checks for and raises an error if it encounters an ExternalLink or SoftLink, thereby mitigating the vulnerability.
KerasFileEditor._extract_weights_from_storekeras/src/saving/file_editor.py
load_weightskeras/src/saving/saving_api.py