CVE-2026-9335 Improper Handling of HDF5 ExternalLinks in keras-team/keras
Attackers can disclose sensitive local files by crafting malicious HDF5 models with external links, bypassing security checks in Keras.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-9335?
CVE-2026-9335 is a medium-severity path traversal vulnerability in keras-team/keras, published on 2 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
Weakness: CWE-22
Which versions are affected by CVE-2026-9335?
5 open source packages ship an affected version, including keras.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | All versions | 3.12.3, 3.15.0 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | All versions | 3.12.3 |
keras PyPI | From 3.13.0 | 3.15.0 |
keras PyPI | From 3.13.0 | 3.15.0 |
How do I fix CVE-2026-9335?
Upgrade keras to a fixed version for your release line: 3.12.3 or 3.15.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-9335 being exploited?
There is no known exploitation of CVE-2026-9335 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-9335, GHSA-m8wh-29wm-52mv, MINI-6f84-p3g2-r5w2, PYSEC-2026-3633, UBUNTU-CVE-2026-9335.