By vendor

Keras vulnerabilities

Known CVEs affecting Keras products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-11816HIGH 8.1

  Keras, a widely-used machine learning library, contains a path traversal vulnerability in its archive extraction functions that can allow attackers to write files outside the intended extraction directory. The vulnerability affects Keras versions before 3.14.0 and stems from validation logic that checks paths against the wrong directory reference—the process's current working directory instead of where files are actually being extracted. In common environments like Docker containers and Jupyter notebooks where the working directory is set to the filesystem root, this check becomes ineffective. An attacker can craft a malicious archive that, when extracted by a vulnerable Keras application, overwrites critical files on the system or injects malicious code into machine learning pipelines.