GitHub Advisoryadvisory · PyPI

GHSA-x4wf-678h-2pmq Keras code injection vulnerability

CRITICAL Published 2024-04-16 Modified 2024-08-02 Official page ↗
Aliases
CVE-2024-3660
Ecosystem
PyPI
Packages
keras
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-08-02

Affected packages

• PyPI keras: < 2.13.1rc0 → fixed in 2.13.1rc0

Description

A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

Related

Alias · CVE (1)

  • CVE-2024-3660 A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References