AIKIDO-2026-290660
keras is vulnerable to Unsafe Deserialization
75
High Risk
This Affects:
kerasTL;DR
keras.datasets.imdb.load_data and reuters.load_data loaded their .npz archives with np.load(allow_pickle=True), and cifar10/cifar100 batch loading used a bare cPickle.load. A crafted or tampered dataset file can therefore unpickle arbitrary objects and run code through a pickle __reduce__ gadget. The fix routes these loaders through a numpy-only RestrictedUnpickler that permits only array reconstruction, so genuine datasets still load while gadget payloads are refused.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load IMDB, Reuters, or CIFAR dataset files that an attacker can replace or supply (for example a poisoned local cache or a custom path to untrusted archives).
Background info
keras is vulnerable to Unsafe Deserialization in versions 3.0.0 - 3.12.3 and 3.13.0 - 3.15.0.
How to fix this
Upgrade the keras library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant