CVE-2026-12480: Keras: HDF5 virtual datasets can disclose local files
(updated )
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim’s filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.
References
- github.com/advisories/GHSA-26c4-7vv6-867j
- github.com/keras-team/keras/commit/8f987f11bf7512f0df4774a8f1557bba07dc2b49
- github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c
- github.com/keras-team/keras/releases/tag/v3.12.3
- github.com/keras-team/keras/releases/tag/v3.15.0
- huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7
- nvd.nist.gov/vuln/detail/CVE-2026-12480
Code Behaviors & Features
Detect and mitigate CVE-2026-12480 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →