CVE-2026-9335: A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improp

Keras (a machine learning library) versions 3.14.0 and earlier have a vulnerability where certain functions bypass safety checks and automatically follow ExternalLinks (references to files outside the main file) in HDF5 files (a format for storing large scientific data). An attacker can create a malicious Keras model file that tricks the library into reading sensitive data from anywhere on a victim's computer and either extracting it or loading it into the user's model.