Keras: Lambda deserialization can bypass safe mode and execute code
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the _raise_for_lambda_deserialization() function fails to enforce the safe-mode guard when safe_mode is set to None, which is the default value when from_config() is called outside of a SafeModeScope context. This logic error conflates None (unset/default-deny) with False (explicitly disabled), bypassing the guard and allowing attacker-controlled marshal bytecode to be deserialized. Affected call sites include keras.layers.deserialize(config), keras.models.clone_model(model), and any direct invocation of Lambda.from_config(config) without an enclosing SafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | keras | < 3.12.3, >= 3.13.0, < 3.15.0 | 3.12.3, 3.15.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-12481
- https://github.com/keras-team/keras/pull/23048
- https://github.com/keras-team/keras/pull/23165
- https://github.com/keras-team/keras/commit/55888d3becbdbb45dc16a55b489900f911e2dde5
- https://github.com/keras-team/keras/commit/d338a45204bdc787c8b3c4a9b82c1911cd52dedf
- https://github.com/keras-team/keras
- https://github.com/keras-team/keras/releases/tag/v3.12.3
- https://github.com/keras-team/keras/releases/tag/v3.15.0
- https://huntr.com/bounties/59ceaed1-c8a3-4135-8f94-169ade02823d
- https://pypi.org/project/keras
- https://github.com/advisories/GHSA-5gwj-m78q-7pq3
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Python (PyPI)
- Package
keras- Disclosed
- 03.07.2026
- Updated
- 11.10.2026 14:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3631 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5gwj-m78q-7pq3 - CC BY 4.0
Vulnerability history: keras
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 20
- First → latest
- 04.2024 08.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 11
- Medium 6
- Low 1
Disclosures per year
- 2024: 1
- 2025: 8
- 2026: 11
-
Keras: Lambda deserialization can bypass safe mode and execute code this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.