fix(deps): update dependency keras to v3.15.0 [security] - #1048
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update dependency keras to v3.15.0 [security]#1048renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Coverage variation | ✅ +0.00% coverage variation (-1.00%) |
| Diff coverage | ✅ ∅ diff coverage |
Coverage variation details
Coverable lines Covered lines Coverage Common ancestor commit (509958e) 720 517 71.81% Head commit (197bd74) 720 (+0) 517 (+0) 71.81% (+0.00%) Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch:
<coverage of head commit> - <coverage of common ancestor commit>
Diff coverage details
Coverable lines Covered lines Diff coverage Pull request (#1048) 0 0 ∅ (not applicable) Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified:
<covered lines added or modified>/<coverable lines added or modified> * 100%
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.14.1→==3.15.0Keras: DiskIOStore permits path traversal through crafted layer names
CVE-2026-12479 / GHSA-gh82-f9x8-5frx
More information
Details
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the
DiskIOStore.makemethod within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (..). While forward slashes (/) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations.Severity
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Keras: HDF5 virtual datasets can disclose local files
CVE-2026-12480 / GHSA-26c4-7vv6-867j
More information
Details
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the
H5IOStore._verify_dataset()andfile_editor.pymethods, which fail to check thedataset.is_virtualproperty of HDF5 datasets. This allows an attacker to craft a malicious.kerasmodel archive or.h5weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim's filesystem. When the victim loads the model usingkeras.models.load_model()orkeras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.Severity
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Keras: Lambda deserialization can bypass safe mode and execute code
CVE-2026-12481 / GHSA-5gwj-m78q-7pq3
More information
Details
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the
Lambdalayer. Specifically, the_raise_for_lambda_deserialization()function fails to enforce the safe-mode guard whensafe_modeis set toNone, which is the default value whenfrom_config()is called outside of aSafeModeScopecontext. This logic error conflatesNone(unset/default-deny) withFalse(explicitly disabled), bypassing the guard and allowing attacker-controlledmarshalbytecode to be deserialized. Affected call sites includekeras.layers.deserialize(config),keras.models.clone_model(model), and any direct invocation ofLambda.from_config(config)without an enclosingSafeModeScope(True). This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Keras: tar extraction permits symlink-based path traversal
CVE-2026-12482 / GHSA-58hv-7753-xmfq
More information
Details
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the
filter_safe_tarinfosvalidation inkeras/src/utils/file_utils.py. Specifically, symlink entries are not subjected to the sameis_path_in_dirvalidation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, wherefilter_safe_tarinfosis the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues.Severity
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
CVE-2026-12484 / GHSA-v2w2-w228-c444
More information
Details
A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public
keras.layers.TorchModuleWrapper.from_configmethod. This method invokestorch.load(..., weights_only=False)without requiring an explicit unsafe opt-in, such as asafe_mode=Falseparameter. When called outside aSafeModeScope(True)context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.Severity
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Keras: HDF5 links can disclose local file contents
CVE-2026-9335 / GHSA-m8wh-29wm-52mv
More information
Details
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The
KerasFileEditorandkeras.saving.load_weightsfunctions bypass thesafe_get_h5_groupandsafe_get_h5_datasethelpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically,KerasFileEditorextracts attributes and datasets from linked files into its internal structures, whilekeras.saving.load_weightsloads weights from linked files into the user's model. This issue can be exploited by providing a malicious.h5,.weights.h5, or.kerasfile containing ExternalLinks.Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
keras-team/keras (keras)
v3.15.0Compare Source
Highlights
export_torchenables exporting Keras models to native PyTorchnn.Moduleformat, along with LiteRT (TFLite) export support for the PyTorch backend.sliding_windowparameter toMultiHeadAttentionandGroupedQueryAttentionfor efficient long-context attention.MultiOptimizersupports assigning different optimizers to sub-networks.unique,pinv,matrix_rank,fabs,fmax,fmin,erfc,dsplit,percentile,nanpercentile,sobel_edges, andssim(structural similarity) tokeras.ops.New Features and Operations
Multi-Backend Operations
unique,fabs,fmax,fmin,dsplit,erfc,percentile,nanpercentileinkeras.ops.numpy.pinv(pseudo-inverse) andmatrix_rankinkeras.ops.linalg.sobel_edgesfor edge detection andssim(structural similarity) inkeras.ops.image.keras.ops.transposenow supports negative axis values.Layers and Attention
MultiHeadAttentionandGroupedQueryAttentionlayers support thesliding_windowparameter for efficient long-sequence processing.Training and Optimizers
predict_probamethod toSKLearnClassifier.Export and Deployment
nn.Moduleviamodel.export(..., format="torch").Distribution and Parallelism
num_processes,num_model_replicas,data_shard_id).OpenVINO Backend Support
The OpenVINO backend received continued improvements:
glu,sparsemax,gaussian_blur,logdet,cholesky,lu_factor,erfc,segment_min,segment_prod,percentile,nanmedian,nanpercentile,unique,flash_attn,greedy ctc_decode,solve_triangular,compute_homography_matrix, and image transforms (affine, perspective, elastic).Security
ExternalLink/SoftLinkgroups, virtual datasets, and shape-bomb datasets in model loading.np.load, fix insecure deserialization in dataset utilities, and makeLambda/TorchModuleWrapperfrom_configfail closed whensafe_modeis unset.Bug Fixes and Improvements
Backend Specific Improvements
convert_to_tensorfor Python scalars,divide_no_nan()NaN gradients, BiLSTM dispatch,lstsqwith rcond,SymInt/SymFloathandling inconvert_to_tensorandslice, and median for even-length inputs.tf.tensordotby removing redundant float casts.Layers and Ops
GroupNormalizationwith small epsilon; disabled autocast for mixed precision stability.BatchMatMulV2gradient materialization.return_attention_scores.output_paddinginConv1D/2D/3DTransposeget_config.return_attention_scoresflag incompute_output_spec; save seed inget_config.softmax,normalize,swapaxes,moveaxis,sort,argsort,cumsum,cumprod,take,stack,concatenate,split,diff,transpose, and more.compute_output_shapeto work before build.Model Saving and Loading
from_configlayers and avoid mutating input config.Other Improvements
EarlyStopping/ReduceLROnPlateauresettingself.bestbetween fit calls; fixedTensorBoardcallback step counter never updating.tree.flattenandtree.map_structurefor common cases.L1L2regularizer.CITATION.cfffor repository citation.New Contributors
We would like to thank our new contributors for making their first contribution to the Keras project:
Full Changelog: keras-team/keras@v3.14.0...v3.15.0
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.