The vulnerability in keras 3.13.0's TFSMLayer class permits deserialization of attacker-controlled TensorFlow SavedModels despite safe_mode=True, which is intended to prevent unsafe code execution. This occurs because the deserialization process unconditionally loads external SavedModels and does not validate file paths or configurations in from_config(), enabling arbitrary code execution during model inference. The CVSS 3.0 score is 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. Vendor advisories from Red Hat acknowledge the issue but do not currently provide a patch or remediation guidance.

Successful exploitation allows an attacker to execute arbitrary code on the victim's system with the privileges of the user running the keras model inference. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability bypasses the intended safe_mode security mechanism, increasing risk during model deserialization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid loading untrusted .keras models or TensorFlow SavedModels. Monitor vendor advisories, especially from keras-team and Red Hat, for updates on patches or mitigations.