CVE-2024-3660: Keras code injection vulnerability
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.
Published Apr 16, 2024 · Updated Aug 2, 2024
Affected packages
keras
- Ecosystem
- PyPI
- Affected
- < 2.13.1rc0
- Fixed in
- 2.13.1rc0
- Check
pip show keras
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology