The vulnerability in keras-team/keras version 3.15.0 involves the unsafe deserialization of PyTorch pickle data through the public method keras.layers.TorchModuleWrapper.from_config. This method invokes torch.load with weights_only=False without requiring an explicit unsafe opt-in parameter such as safe_mode=False. When this method is called outside a SafeModeScope(True) context, the absence of an ambient safe mode state allows unsafe deserialization by default. This can lead to arbitrary code execution if untrusted Keras layer configurations are deserialized using this method. The root cause is the lack of enforced safe deserialization practices unless explicitly enabled by Keras safe mode.

Successful exploitation of this vulnerability can result in arbitrary code execution due to unsafe deserialization of attacker-controlled data. This impacts confidentiality, integrity, and availability of the affected system. The CVSS score of 7.8 reflects high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted Keras layer configurations with the TorchModuleWrapper.from_config method or ensure that calls to this method occur within a SafeModeScope(True) context to enforce safe deserialization. Monitor the official keras-team advisories for updates and patches addressing this issue.