AIKIDO-2026-10137

TL;DR

Affected versions of this package allow TFSMLayer to load external TensorFlow SavedModels during deserialization without honoring safe_mode, enabling attacker-controlled graphs to be registered and later executed during normal inference. An attacker could exploit this by supplying a malicious SavedModel (e.g., via a crafted config or model artifact) that bypasses safe_mode=True, causing unintended graph execution when the model is invoked, effectively violating Keras' safe deserialization guarantees and enabling execution of untrusted computation without explicit user opt-in.