CVE-2026-9335 Details
Description
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
A vulnerability in Keras versions through 3.14.0 allows for arbitrary local HDF5 file content disclosure. This issue arises from improper handling of HDF5 ExternalLinks by the KerasFileEditor and the keras.saving.load_weights functions, which bypass the safe_get_h5_group and safe_get_h5_dataset helpers designed to reject such links. As a result, links to external HDF5 files are automatically dereferenced, enabling the extraction of sensitive data from the local filesystem. The KerasFileEditor can inadvertently exfiltrate data by writing linked file contents back as regular datasets, while the load_weights function incorporates weights from these files into the user's model. The vulnerability can be exploited by uploading a malicious HDF5 file containing ExternalLinks or SoftLinks.
Users can upgrade to Keras version 3.15.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 2, 2026 | New CVE Received | [email protected] |