CVE-2026-9335

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.

• CWE-22

• https://github.com/keras-team/keras/commit/23370f16b0ab9a200f7550a34e54a3ceab74ba0e
• https://huntr.com/bounties/876a7226-5428-4a66-9d05-232461120db5

Published

Aug 2, 2026

Last Modified

Aug 31, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93341MarketKing plugin for WordPress before 2.1.72 contains a mis…4.3
• CVE-2026-93342MarketKing plugin for WordPress before 2.1.72 contains a mis…5.4
• CVE-2026-93343MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93344MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93345MikroTik RouterOS before 7.25beta4 contains an improper inpu…7.5
• CVE-2026-93349Frictionless through 5.20.0rc1 contains an OS command inject…8.8
• CVE-2026-93352Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete p…9.8
• CVE-2026-93353copyparty contains a volume restriction bypass vulnerability…5.3
• CVE-2026-93354Taskview Community before 1.56.0 contains a missing authenti…8.1
• CVE-2026-9336IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.5
• CVE-2026-93363The @payloadcms/storage-vercel-blob storage adapter for Payl…4.3
• CVE-2026-93364Bludit CMS through 3.22.0 contains a mass assignment vulnera…4.3