Homepage

External Control of File Name or Path Affecting py3.13-keras package, versions <3.15.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.13% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-PY313KERAS-18599266
  • published9 Aug 2026
  • disclosed1 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 1 Jul 2026

CVE-2026-12480  (opens in a new tab)
CWE-73  (opens in a new tab)

How to fix?

Upgrade Minimos:latest py3.13-keras to version 3.15.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream py3.13-keras package and not the py3.13-keras package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.2 and 3.14.1.