CVE-2026-12480: CWE-73 External Control of File Name or Path in keras-team keras-team/keras
Keras versions before 3.12.2 and between 3.12.3 and before 3.14.1 contain a vulnerability that allows an attacker to craft malicious model files with Virtual Datasets referencing external files. Loading such models can cause unintended reading of external files, potentially disclosing sensitive information. This issue is due to incomplete validation of the dataset's virtual property. The vulnerability is fixed in versions 3.12.2 and 3.14.1.
AI Analysis
Technical Summary
CVE-2026-12480 affects keras-team/keras where an incomplete fix for a prior vulnerability (CVE-2026-1669) leaves the `H5IOStore._verify_dataset()` and `file_editor.py` methods vulnerable. These methods fail to properly check the `dataset.is_virtual` property in HDF5 datasets, allowing crafted `.keras` or `.h5` files containing Virtual Datasets (VDS) that reference external HDF5 files on the victim's filesystem. When such a model is loaded using `keras.models.load_model()` or `keras.saving.load_model()`, the external files are read transparently, leading to potential information disclosure. The vulnerability is resolved in versions 3.12.2 and 3.14.1.
Potential Impact
An attacker can cause a victim loading a malicious Keras model or weights file to inadvertently read external files on their filesystem. This leads to information disclosure of file contents without user consent. There is no indication of integrity or availability impact. The attack requires the victim to load a crafted model file, and user interaction is needed (UI:R).
Mitigation Recommendations
A fix is available in Keras versions 3.12.2 and 3.14.1. Users should upgrade to one of these versions or later to remediate this vulnerability. No other mitigations are indicated or necessary according to the vendor advisory.
CVE-2026-12480: CWE-73 External Control of File Name or Path in keras-team keras-team/keras
Description
Keras versions before 3.12.2 and between 3.12.3 and before 3.14.1 contain a vulnerability that allows an attacker to craft malicious model files with Virtual Datasets referencing external files. Loading such models can cause unintended reading of external files, potentially disclosing sensitive information. This issue is due to incomplete validation of the dataset's virtual property. The vulnerability is fixed in versions 3.12.2 and 3.14.1.
CVSS v3.0
Score 5.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12480 affects keras-team/keras where an incomplete fix for a prior vulnerability (CVE-2026-1669) leaves the `H5IOStore._verify_dataset()` and `file_editor.py` methods vulnerable. These methods fail to properly check the `dataset.is_virtual` property in HDF5 datasets, allowing crafted `.keras` or `.h5` files containing Virtual Datasets (VDS) that reference external HDF5 files on the victim's filesystem. When such a model is loaded using `keras.models.load_model()` or `keras.saving.load_model()`, the external files are read transparently, leading to potential information disclosure. The vulnerability is resolved in versions 3.12.2 and 3.14.1.
Potential Impact
An attacker can cause a victim loading a malicious Keras model or weights file to inadvertently read external files on their filesystem. This leads to information disclosure of file contents without user consent. There is no indication of integrity or availability impact. The attack requires the victim to load a crafted model file, and user interaction is needed (UI:R).
Mitigation Recommendations
A fix is available in Keras versions 3.12.2 and 3.14.1. Users should upgrade to one of these versions or later to remediate this vulnerability. No other mitigations are indicated or necessary according to the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- @huntr_ai
- Date Reserved
- 2026-06-17T00:57:28.799Z
- Cvss Version
- 3.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a45492827e9c79719d6203b
Added to database: 07/01/2026, 17:06:48 UTC
Last enriched: 08/08/2026, 15:12:17 UTC
Last updated: 08/14/2026, 12:41:08 UTC
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.