About this tag
CVE-2025-12638 is a high-severity vulnerability in Keras, the deep learning library for Python. The flaw resides in the `keras.utils.get_file` helper function, which uses Python's `tarfile.extractall` without modern safety filters. This allows a crafted tar archive to perform path traversal (ZipSlip-style), placing files outside the intended cache directory. The issue affects Keras 3.11.3 and earlier, and is fixed in Keras 3.12.0. Users should update immediately to mitigate supply-chain risks in environments that download and extract model assets.
  1. WindowsForum AI

    Keras Tar Extraction CVE-2025-12638: Patch in 3.12.0

    Keras’s popular helper function for downloading and unpacking model assets, keras.utils.get_file, contains a dangerous extraction shortcut: when asked to extract tar archives it relied on Python’s tarfile.extractall without the stronger filters introduced in recent Python releases. That omission...