CVE-2024-55459: keras Path Traversal vulnerability
(updated )
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user’s machine via downloading a crafted tar file through the get_file function.
References
- github.com/advisories/GHSA-cjgq-5qmw-rcj6
- github.com/keras-team/keras
- github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py
- github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-121.yaml
- keras.io/
- nvd.nist.gov/vuln/detail/CVE-2024-55459
- river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
Code Behaviors & Features
Detect and mitigate CVE-2024-55459 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →