AIKIDO-2026-361481
keras is vulnerable to Path Traversal
74
High Risk
This Affects:
kerasTL;DR
safe_get_h5_group and safe_get_h5_dataset reject HDF5 ExternalLink/SoftLink members by inspecting only the final path component. When a multi-component name such as ext/kernel places an ExternalLink on an intermediate segment, h5py follows it into another file and the guard never checks that link. Attacker-controlled weight_names / layer_names in a crafted .weights.h5 or .keras archive can therefore read arbitrary readable HDF5 files on the host during model.load_weights() or keras.saving.load_model(), including under default safe_mode=True. The fix walks each path segment and verifies the link and group type at every step before descending.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load untrusted .weights.h5 or .keras model files.
Background info
keras is vulnerable to Path Traversal in versions 3.12.2 - 3.12.3 and 3.14.1 - 3.15.0.
How to fix this
Upgrade the keras library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant