These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of a [truncated]
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-base [truncated]
A path traversal vulnerability was discovered in the keras-team/keras library, version 3.14.0. The vulnerability exists in the `DiskIOStore.make` method, where user-provided layer names are used to construct directory paths without proper sanitization. This allows attackers to craft malicious Keras models that can escape the intended temporary working directory and perform unauthorized file system operati [truncated]
A path traversal vulnerability was discovered in the archive extraction utilities of Keras, specifically in the `filter_safe_tarinfos()` and `filter_safe_zipinfos()` functions located in `keras/src/utils/file_utils.py`. These functions validate archive member paths against the process's current working directory (CWD) instead of the actual extraction destination. This can be exploited when the process run [truncated]
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the u [truncated]