HighVulnerability

CVE-2026-9335: keras-team/keras local HDF5 file disclosure through ExternalLinks

Source: NVD(opens in a new tab)
Identifier: CVE-2026-9335
Published: August 2, 2026
Record updated: October 9, 2026

Affected: keras < 3.12.3, fixed in 3.12.3, released June 26, 2026, 37 days before disclosure
keras >= 3.13.0, < 3.15.0, fixed in 3.15.0, released June 24, 2026, 39 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.8%

Summary

CVE-2026-9335 affects keras-team/keras versions <= 3.14.0. The KerasFileEditor and keras.saving.load_weights functions bypass the safe_get_h5_group and safe_get_h5_dataset helpers, so HDF5 ExternalLinks are automatically dereferenced. An attacker can supply a malicious .h5, .weights.h5, or .keras file with ExternalLinks to disclose sensitive data from the victim's local filesystem.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.8%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 3, 2026.
Disclosure date: August 2, 2026

Weaknesses and techniques

Weakness (CWE): CWE-22
Attack pattern (CAPEC): CAPEC-126

Affected

Packages: keras@< 3.12.3 (fixed: 3.12.3)
keras@>= 3.13.0, < 3.15.0 (fixed: 3.15.0)

Classification

Attack type: Data extraction
Attack sophistication: Moderate
AI component targeted: Framework
Impact: Confidentiality
Labels: security,
privacy

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-9335

First tracked: August 2, 2026 at 02:07 AM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

kerasPyPINo LLM dependency detected · 6 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items