CVE-2026-9335 is a path traversal vulnerability (CWE-22) in keras-team/keras versions <= 3.14.0. The vulnerability stems from the KerasFileEditor and keras.saving.load_weights functions bypassing the safe_get_h5_group and safe_get_h5_dataset helpers, which are designed to reject HDF5 ExternalLinks and SoftLinks. This bypass results in automatic dereferencing of ExternalLinks to external HDF5 files, enabling an attacker to disclose arbitrary local file contents by providing a malicious .h5, .weights.h5, or .keras file containing such links. The vulnerability allows disclosure of sensitive data from the victim's local filesystem without requiring privileges or causing denial of service.

An attacker can craft malicious HDF5 files that, when loaded by vulnerable Keras functions, cause disclosure of arbitrary local file contents via ExternalLinks. This compromises confidentiality by exposing sensitive data on the victim's filesystem. There is no indication of integrity or availability impact. The attack requires user interaction (loading a malicious file) but no privileges. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading untrusted .h5, .weights.h5, or .keras files that may contain ExternalLinks. Monitoring vendor channels for updates is recommended.