CVE-2026-12480: Keras: HDF5 virtual datasets can disclose local files
(updated )
Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore._verify_dataset() and file_editor.py methods, which fail to check the dataset.is_virtual property of HDF5 datasets. This allows an attacker to craft a malicious .keras model archive or .h5 weights file containing a Virtual Dataset (VDS) that references external HDF5 files on the victim’s filesystem. When the victim loads the model using keras.models.load_model() or keras.saving.load_model(), the external file is transparently read, leading to potential information disclosure. Fixed in versions 3.12.3 and 3.15.0.
References
- github.com/advisories/GHSA-26c4-7vv6-867j
- github.com/keras-team/keras/commit/8f987f11bf7512f0df4774a8f1557bba07dc2b49
- github.com/keras-team/keras/commit/d5a88bdb137c0d3039b8f4bbbe8c7099925cc10c
- github.com/keras-team/keras/releases/tag/v3.12.3
- github.com/keras-team/keras/releases/tag/v3.15.0
- huntr.com/bounties/1875d257-5b03-4a69-ac70-e98653fa12c7
- nvd.nist.gov/vuln/detail/CVE-2026-12480
Code Behaviors & Features
Detect and mitigate CVE-2026-12480 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →