CVE Feed

    Dashboard / CVE / CVE-2026-9335

    CVE-2026-9335

    A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.

    Published:Aug 2, 2026
    Last Modified:Aug 3, 2026
    EPS:Aug 2, 2026
    EPSS Score:0.00646
    CVSS Score:6.5

    Affected Products

    Vendor
    Keras-team
    Product
    Keras

    Exploits

    https://github.com/paparojonathan/CVE-2026-9335-keras-hdf5-externallink

    Related CVEs

    CVE-2026-12570 (CVSS 5.5) — A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loadin…
    CVE-2026-12484 (CVSS 7.8) — A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorc…
    CVE-2026-12482 (CVSS 6.5) — A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that by…
    CVE-2026-12481 (CVSS 9.8) — A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handlin…
    CVE-2026-12480 (CVSS 5.5) — Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete f…
    CVE-2026-12479 (CVSS 6.1) — A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.mak…
    CVE-2026-11816 (CVSS 8.1) — Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities lo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High