{"data":{"id":"0d6ec266-36c5-4f24-846d-86be6188810b","title":"CVE-2025-12058: The Keras.Model.load_model method, including when executed with the intended security mitigation safe_mode=True, is…","summary":"CVE-2025-12058 affects the Keras.Model.load_model method, including when called with safe_mode=True. Loading a specially crafted .keras archive with a malicious vocabulary path in the StringLookup layer's configuration lets an attacker read arbitrary local files, retrievable via get_vocabulary(). Because Keras uses tf.io.gfile, which supports remote filesystems and HTTP/HTTPS, the same path can also trigger server-side requests to arbitrary network endpoints. The safe_mode=True flag did not restrict this external path loading.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-12058","publishedAt":"2025-10-29T13:15:35.500Z","cveId":"CVE-2025-12058","cweIds":["CWE-502"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["keras@< 3.12.0 (fixed: 3.12.0)"],"affectedPackageNames":["keras"],"affectedPackageRefs":["pypi:keras"],"affectedVendors":["Google"],"affectedVendorsRaw":["Keras","TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Keras load_model arbitrary local file read and SSRF via StringLookup vocabulary","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00248,"epssCheckedAt":"2026-11-04T18:09:13.788Z","kevDateAdded":null,"advisoryAliases":["GHSA-mq84-hjqx-cwf2"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:13.653Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-10-27T20:23:09.571Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:43:22.307Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"keras","fixedVersion":"3.12.0","matchedVersion":"3.12.0","fixReleasedAt":"2025-10-27T20:23:09.571Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:22.157Z"}]}}