CVE-2026-9335

Name of the Vulnerable Software and Affected Versions keras-team/keras versions prior to 3.14.1

Description Improper handling of HDF5 ExternalLinks allows for arbitrary local HDF5 file content disclosure. The KerasFileEditor and keras.saving.load weights functions bypass the safe get h5 group and safe get h5 dataset helpers, which are intended to reject ExternalLinks and SoftLinks. This leads to the automatic dereferencing of links to external HDF5 files, allowing attackers to disclose sensitive data from the local filesystem by providing a malicious .h5, .weights.h5, or .keras file. Specifically, KerasFileEditor extracts attributes and datasets from linked files, and keras.saving.load weights loads weights from these linked files into the user's model.

Recommendations Update to a version newer than 3.14.0. As a temporary workaround, avoid using the KerasFileEditor and keras.saving.load weights functions with untrusted .h5, .weights.h5, or .keras files.