CVE-2026-12481 Deserialization of Untrusted Data in keras-team/keras
Attackers can execute arbitrary code via unsafe deserialization in Keras Lambda layers when safe mode is not explicitly enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-12481?
CVE-2026-12481 is a high-severity unsafe deserialization vulnerability in keras-team/keras, published on 3 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.
Weakness: CWE-502
Which versions are affected by CVE-2026-12481?
5 open source packages ship an affected version, including keras. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | All versions | 3.12.3, 3.15.0 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | From 3.13.0 | 3.15.0 |
keras PyPI | From 3.13.0 | 3.15.0 |
Products include Keras Keras.
How do I fix CVE-2026-12481?
Upgrade keras to a fixed version for your release line: 3.12.3 or 3.15.0.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-12481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12481 exists.
Other vulnerabilities in keras-team/keras
- CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13
- CVE-2026-1462 Safe Mode Bypass in keras-team/keras
- CVE-2025-9906 Arbitrary Code execution in Keras Safe Mode
- CVE-2025-8747 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.
- CVE-2026-11816 Path Traversal in keras-team/keras
Sources
Also known as DEBIAN-CVE-2026-12481, GHSA-5gwj-m78q-7pq3, MINI-9cp3-3crh-vwr4, PYSEC-2026-3631, UBUNTU-CVE-2026-12481.