{"items":[{"id":"NVI-00015106","kind":"vulnerability","title":"Keras: Lambda deserialization can bypass safe mode and execute code","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-5gwj-m78q-7pq3","CVE-2026-12481"],"plain_summary":"GitHub lists this reviewed advisory for keras, keras. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2c862dd502513038cbd4ef1e59c7c242"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-07T20:30:43.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-22b7a3c2ad73a4fddd7c65c105c3400b"},{"kind":"CVSS","as_of":"2026-10-25T15:10:00.147Z","value":"8.8 HIGH (3.0)","meaning":"security@huntr.dev severity; no combined Null risk score.","source_id":"sr-2c862dd502513038cbd4ef1e59c7c242"},{"kind":"CVSS","as_of":"2026-10-25T15:10:00.147Z","value":"9.8 CRITICAL (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-2c862dd502513038cbd4ef1e59c7c242"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-22b7a3c2ad73a4fddd7c65c105c3400b","url":"https://github.com/advisories/GHSA-5gwj-m78q-7pq3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5gwj-m78q-7pq3","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:17:12.848Z"},{"id":"sr-2c862dd502513038cbd4ef1e59c7c242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12481","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-12481","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-07T13:55:30.071Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-22b7a3c2ad73a4fddd7c65c105c3400b"],"technology":"keras","known_exclusions":[],"conditions_summary":"A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.","public_affected_ranges":["< 3.12.3"]},{"certainty":"source_listed","source_ids":["sr-22b7a3c2ad73a4fddd7c65c105c3400b"],"technology":"keras","known_exclusions":[],"conditions_summary":"A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.","public_affected_ranges":[">= 3.13.0, < 3.15.0"]}],"null_published_at":"2026-11-07T18:43:12.079Z","source_updated_at":"2026-08-07T20:30:43.000Z","source_disclosed_at":"2026-07-03T21:31:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T20:17:12.848Z"},{"id":"NVI-00015106","kind":"vulnerability","title":"Keras: Lambda deserialization can bypass safe mode and execute code","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-5gwj-m78q-7pq3","CVE-2026-12481"],"plain_summary":"GitHub lists this reviewed advisory for keras, keras. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-22b7a3c2ad73a4fddd7c65c105c3400b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-07T20:30:43.000Z","value":"8.8 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-22b7a3c2ad73a4fddd7c65c105c3400b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-22b7a3c2ad73a4fddd7c65c105c3400b","url":"https://github.com/advisories/GHSA-5gwj-m78q-7pq3","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-5gwj-m78q-7pq3","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:17:12.848Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-22b7a3c2ad73a4fddd7c65c105c3400b"],"technology":"keras","known_exclusions":[],"conditions_summary":"A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.","public_affected_ranges":["< 3.12.3"]},{"certainty":"source_listed","source_ids":["sr-22b7a3c2ad73a4fddd7c65c105c3400b"],"technology":"keras","known_exclusions":[],"conditions_summary":"A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.","public_affected_ranges":[">= 3.13.0, < 3.15.0"]}],"null_published_at":"2026-11-03T10:03:26.549Z","source_updated_at":"2026-08-07T20:30:43.000Z","source_disclosed_at":"2026-07-03T21:31:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:17:12.848Z"}],"next_cursor":null,"snapshot_revision":"42594"}