CVE-2026-12481

Name of the Vulnerable Software and Affected Versions keras-team/keras version 3.14.0

Description Improper handling of deserialization in the Lambda layer allows for arbitrary OS-level code execution in the context of the server or user process. The raise for lambda deserialization() function fails to enforce the safe-mode guard when safe mode is set to None, which is the default value when from config() is called outside of a SafeModeScope context. This logic error treats None as False, bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include the keras.layers.deserialize(config) and keras.models.clone model(model) endpoints, as well as any direct invocation of the Lambda.from config(config) function without an enclosing SafeModeScope(True).

Recommendations For version 3.14.0, ensure that Lambda.from config(config) is called within an enclosing SafeModeScope(True) to enforce the safe-mode guard. As a temporary mitigation, restrict the use of the keras.layers.deserialize(config) and keras.models.clone model(model) endpoints when processing untrusted configurations.