NIXPKGS-2026-0240

GitHub issue published 5 months, 1 week ago

Permalink CVE-2026-1669

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 2 weeks ago
@LeSuisse ignored
2 packages
- python313Packages.tf-keras
- python312Packages.tf-keras
5 months, 1 week ago
@LeSuisse accepted 5 months, 1 week ago
@LeSuisse published on GitHub 5 months, 1 week ago

Arbitrary File Read in Keras via HDF5 External Datasets

Arbitrary file read in the model loading mechanism (HDF5 integration) in Keras versions 3.0.0 through 3.13.1 on all supported platforms allows a remote attacker to read local files and disclose sensitive information via a crafted .keras model file utilizing HDF5 external dataset references.

References

https://github.com/google/security-research/security/advisories

Affected products

Keras

<3.13.1

Matching in nixpkgs

pkgs.python312Packages.keras

None

pkgs.python313Packages.keras

Multi-backend implementation of the Keras API, with support for TensorFlow, JAX, and PyTorch

nixos-unstable 3.13.2
- nixpkgs-unstable 3.13.2
- nixos-unstable-small 3.13.2

pkgs.pkgsRocm.python3Packages.keras

Multi-backend implementation of the Keras API, with support for TensorFlow, JAX, and PyTorch

nixos-unstable 3.13.2
- nixpkgs-unstable 3.13.2
- nixos-unstable-small 3.13.2

Ignored packages (2)

pkgs.python312Packages.tf-keras

None

pkgs.python313Packages.tf-keras

Deep learning for humans

nixos-unstable 2.20.1
- nixpkgs-unstable 2.20.1
- nixos-unstable-small 2.20.1

Package maintainers

@GaetanLepage Gaetan Lepage <gaetan@glepage.com>

Upstream issue: https://github.com/keras-team/keras/pull/22057

Nixpkgs security tracker

Details of issue NIXPKGS-2026-0240