| Package | Affected versions | Patched versions |
|---|---|---|
| keras | < 3.13.2 | 3.13.2 |
| keras | = 3.13.0 | |
| openshift ai | ≥ 2.25, < 2.25.7 | 2.25.7 |
A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the from_config() method.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free