CVE-2026-12482: A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the

Keras version 3.12.0 has a vulnerability where an attacker can create a specially crafted tar archive (a compressed file format) that gets extracted in unintended locations. The problem is that symlinks (shortcuts that point to other files or directories) bypass safety checks that regular files must pass, allowing attackers to read files, overwrite files, or escape the intended extraction directory. This is especially dangerous on Python 3.10 and 3.11.