This vulnerability in keras-team/keras version 3.13.0 involves unsafe deserialization in the TFSMLayer class. Specifically, attacker-controlled TensorFlow SavedModels can be loaded during deserialization of .keras models despite safe_mode=True, which is intended to prevent such unsafe operations. The root cause is the unconditional loading of external SavedModels and the serialization of attacker-controlled file paths without validation in the from_config() method. This flaw enables arbitrary code execution during model inference under the victim's privileges, representing a critical security risk in environments using this package for machine learning model deployment.

Successful exploitation allows an attacker to execute arbitrary code on the victim's system during model inference, potentially leading to full system compromise under the privileges of the user running the keras model. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability bypasses intended safe_mode protections, increasing the risk of exploitation in environments relying on keras for model loading and inference.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, users should avoid loading untrusted or attacker-controlled .keras models and consider restricting model sources to trusted origins. Monitor official keras-team communications for updates on remediation.