CVE-2026-12484

Keras model wrapper deserialization can execute untrusted code

Keras / HCL · Keras in HCL AION

First documented disclosure · Review checkpoint

Summary

Unsafe model wrapper deserialization can execute untrusted Python objects.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.0. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Keras wrapper can load executable serialized objects while rebuilding a model component without an explicit safe-mode scope.

Conditions required

An application must process an untrusted model wrapper configuration in the affected context.

Potential impact

Code can execute with the privileges of the model-loading process.

Affected versions and configurations

Keras 3.15.0 documented. HCL AION 2.7.0.

Fix and mitigation status

HCL AION 2.8.0. Upstream release unverified.

Practical next steps

Upgrade HCL AION to 2.8.0. Restrict model configurations and verify the upstream fix before accepting third-party artifacts in standalone Keras.

Operating lesson

Apply safe loading at each model-component entry point.

Evidence and limits

The CNA identifies Keras 3.15.0 in its description without a precise upstream patched version. HCL confirms AION 2.7.0 exposure and the AION 2.8.0 fix.

Sources