logo

Database

Server side template injection In keras

Description

Keras code injection vulnerability A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2024-36602. NVD-2024-36603. OSV-DEBIAN-2024-36604. OSV-2024-36605. GCVE-2024-36606. SECURITY-TRACKER-CVE-2024-3660

References

1. https://github.com/aaryanbhujang/CVE-2024-3660-PoC2. https://github.com/keras-team/keras/compare/r2.12...r2.133. https://kb.cert.org/vuls/id/2532664. https://www.kb.cert.org/vuls/id/253266

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.