A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.
References
| Link | Resource |
|---|---|
| https://kb.cert.org/vuls/id/253266 | Third Party Advisory VDB Entry |
| https://www.kb.cert.org/vuls/id/253266 | Third Party Advisory VDB Entry |
| https://kb.cert.org/vuls/id/253266 | Third Party Advisory VDB Entry |
| https://www.kb.cert.org/vuls/id/253266 | Third Party Advisory VDB Entry |
Configurations
History
23 Sep 2025, 01:35
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* | |
| References | () https://kb.cert.org/vuls/id/253266 - Third Party Advisory, VDB Entry | |
| References | () https://www.kb.cert.org/vuls/id/253266 - Third Party Advisory, VDB Entry | |
| First Time |
Keras
Keras keras |
|
| CWE | CWE-94 |
21 Nov 2024, 09:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://kb.cert.org/vuls/id/253266 - | |
| References | () https://www.kb.cert.org/vuls/id/253266 - |
01 Aug 2024, 13:56
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
17 Apr 2024, 12:48
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 21:15
Updated : 2025-09-23 01:35
NVD link : CVE-2024-3660
Mitre link : CVE-2024-3660
CVE.ORG link : CVE-2024-3660
JSON object : View
Products Affected
keras
- keras
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')