CVE-2024-3660
CRITICALKeras < 2.13.1 - Code Injection
Title source: ruleDescription
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.
Exploits (1)
nomisec
WORKING POC
4 stars
by aaryanbhujang · poc
https://github.com/aaryanbhujang/CVE-2024-3660-PoC
Scores
CVSS v3
9.8
EPSS
0.0026
EPSS Percentile
49.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (2)
keras/keras
< 2.13.1
pypi/keras
0 - 2.13.1rc0PyPI
Published
Apr 16, 2024
Tracked Since
Feb 18, 2026