Vulnerability · Published Aug 2, 2026 · Assigned by @huntr_ai
CVE-2026-9335Improper Handling of HDF5 ExternalLinks in keras-team/keras
Medium 6.5
In plain English
A medium-severity path traversal in keras-team/keras from keras-team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | keras | 3.12.3 | GHSA-m8wh-29wm-52mv |
| PyPI | keras | 3.15.0 | GHSA-m8wh-29wm-52mv |
| PyPI | keras | 3.12.3, 3.15.0 | PYSEC-2026-3633 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| keras-team | keras-team/keras | unspecified – before 3.12.3, 3.15.0 |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N