Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-ptyp-n4df-aqf1

Summary

Duplicate Advisory: Keras vulnerable to arbitrary file read in the model loading mechanism (HDF5 integration)
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3m4q-jmj6-r34q. This link is maintained to preserve external references.

## Original Description
Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.

Aliases

alias	GHSA-gfmx-qqqh-f38q

Fixed_packages

Affected_packages

url pkg:pypi/keras@3.0.0

purl pkg:pypi/keras@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-1xj9-1kng-8ua4

vulnerability	VCID-cmug-fp72-8qc4

vulnerability	VCID-dy5p-938j-d7fr

vulnerability	VCID-gu8d-jjtb-zuau

vulnerability	VCID-ptyp-n4df-aqf1

vulnerability	VCID-zsjb-zbnj-z3d8

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keras@3.0.0

url pkg:pypi/keras@3.13.1

purl pkg:pypi/keras@3.13.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-ptyp-n4df-aqf1

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keras@3.13.1

References

reference_url	https://github.com/google/security-research/security/advisories
reference_id
reference_type
scores
url	https://github.com/google/security-research/security/advisories

reference_url	https://github.com/keras-team/keras
reference_id
reference_type
scores
url	https://github.com/keras-team/keras

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2026-1669
reference_id	CVE-2026-1669
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2026-1669

reference_url	https://github.com/advisories/GHSA-gfmx-qqqh-f38q
reference_id	GHSA-gfmx-qqqh-f38q
reference_type
scores
url	https://github.com/advisories/GHSA-gfmx-qqqh-f38q

Weaknesses

cwe_id	73
name	External Control of File Name or Path
description	The product allows user input to control or influence paths or file names that are used in filesystem operations.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ptyp-n4df-aqf1

Vulnerability Instance