These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T07:16:44.370Z and has not been modified since then. This vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function. The H5IOStore.__getitem__ method in keras/src/saving/savi [truncated]
The CVE-2026-9335 vulnerability affects keras-team/keras versions <= 3.14.0, allowing arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file, enabling attackers to disclose sensitive data from the victim's local filesystem. Organizations and individuals using keras-team/keras v [truncated]
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of a [truncated]
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-base [truncated]
A path traversal vulnerability was discovered in the keras-team/keras library, version 3.14.0. The vulnerability exists in the `DiskIOStore.make` method, where user-provided layer names are used to construct directory paths without proper sanitization. This allows attackers to craft malicious Keras models that can escape the intended temporary working directory and perform unauthorized file system operati [truncated]
A path traversal vulnerability was discovered in the archive extraction utilities of Keras, specifically in the `filter_safe_tarinfos()` and `filter_safe_zipinfos()` functions located in `keras/src/utils/file_utils.py`. These functions validate archive member paths against the process's current working directory (CWD) instead of the actual extraction destination. This can be exploited when the process run [truncated]
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the u [truncated]
