Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-12481

Опубликовано: 03 июл. 2026
Источник: redhat
CVSS3: 8.8
EPSS Низкий

Описание

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is set to None, which is the default value when from_config() is called outside of a SafeModeScope context. This logic error conflates None (unset/default-deny) with False (explicitly disabled), bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include keras.layers.deserialize(config), keras.models.clone_model(model), and any direct invocation of Lambda.from_config(config) without an enclosing SafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

A flaw was found in the Keras deep learning library. This vulnerability allows a remote attacker to execute arbitrary code on the system by exploiting improper handling of deserialization in the Lambda layer. Specifically, a security safeguard designed to prevent unsafe deserialization is bypassed when the safe_mode setting is not explicitly enabled, allowing malicious code to be processed. This can lead to complete compromise of the affected server or user process.

Отчет

This is an Important arbitrary code execution vulnerability in the Keras deep learning library, impacting Red Hat OpenShift AI components. The flaw arises from improper deserialization in the Lambda layer, where a security safeguard is bypassed if safe_mode is not explicitly enabled. Exploitation requires user interaction, such as loading a specially crafted Keras model.

Меры по смягчению последствий

To reduce exposure, only deserialize Keras models from trusted sources. When deserializing models, explicitly enable safe_mode by wrapping the deserialization call within a SafeModeScope(True) context. This ensures the deserialization safeguard is enforced, preventing the execution of arbitrary code.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-agent-rhel9Not affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-controller-rhel9Not affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-router-rhel9Not affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-storage-initializer-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-modelmesh-runtime-adapter-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9Affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9Affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-502
https://bugzilla.redhat.com/show_bug.cgi?id=2496942keras: Keras: Arbitrary code execution via deserialization vulnerability

EPSS

Процентиль: 38%
0.00467
Низкий

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 2 месяцев назад

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

CVSS3: 9.8
nvd
около 2 месяцев назад

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

CVSS3: 9.8
debian
около 2 месяцев назад

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrar ...

CVSS3: 8.8
github
около 2 месяцев назад

Keras: Lambda deserialization can bypass safe mode and execute code

EPSS

Процентиль: 38%
0.00467
Низкий

8.8 High

CVSS3