Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

keras-team/keras

              master @ 049ee46
            

Fixes

CVEs

CRITICAL

Peak severity

37.8%

Coverage

Highlights

Arbitrary Code Execution: 13 prior fixes. Scrutinize any change in this area.

keras/src/saving/saving_lib.py: most-fixed (10 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Deserialization of untrusted configurations, Lambda layers, custom functions, or unvalidated symbols allows remote attackers to execute arbitrary code via crafted model archives. Bypasses in safe-mode propagation (e.g., failing to forward safe_mode contexts) historically negated intended protections.

Path Traversal: Archive extraction processes (tar, zip) and model directories have repeatedly allowed directory traversal through symlink/hardlink misuse, missing path prefix validations, and insecure join operations. This permits remote attackers to write files outside of the target directories.

Information Disclosure: Processing untrusted HDF5 model files with unresolved external or virtual datasets allows attackers to read arbitrary files from the victim's host via HDF5 ExternalLink or SoftLink references.