CVE-2024-3660

CRITICAL

Keras < 2.13.1 - Arbitrary Code Injection via Model Loading

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-3660. PoCs published by aaryanbhujang.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-3660, demonstrating arbitrary code execution via a malicious TensorFlow Keras model. The Dockerfile builds a model with an embedded reverse shell payload that executes upon loading in vulnerable TensorFlow versions.

Description

A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

Exploits (1)

nomisec WORKING POC 4 stars
by aaryanbhujang · poc
https://github.com/aaryanbhujang/CVE-2024-3660-PoC

This repository contains a functional exploit for CVE-2024-3660, demonstrating arbitrary code execution via a malicious TensorFlow Keras model. The Dockerfile builds a model with an embedded reverse shell payload that executes upon loading in vulnerable TensorFlow versions.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: TensorFlow Keras < 2.13.0
No auth needed
Prerequisites: Docker environment · Vulnerable TensorFlow version (< 2.13.0) · Network connectivity for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry
https://kb.cert.org/vuls/id/253266
Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/253266

Scores

CVSS v3 9.8
EPSS 0.0037
EPSS Percentile 59.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
keras/keras < 2.13.1
pypi/keras 0 - 2.13.1rc0PyPI
Published Apr 16, 2024
Tracked Since Feb 18, 2026