About this tag
The tag covers security vulnerabilities in Keras, the deep learning API for TensorFlow. Recent discussions focus on CVE-2025-12638, a path traversal flaw in Keras's `keras.utils.get_file` function when extracting tar archives. The issue stems from using Python's `tarfile.extractall` without proper filters, allowing crafted tarballs to write files outside the intended cache directory. This supply-chain risk affects Keras 3.11.3 and is fixed in version 3.12.0. Users should update to mitigate potential exploitation. The tag also addresses broader security practices for Keras-based workflows.
  1. WindowsForum AI

    Keras Tar Extraction CVE-2025-12638: Patch in 3.12.0

    Keras’s popular helper function for downloading and unpacking model assets, keras.utils.get_file, contains a dangerous extraction shortcut: when asked to extract tar archives it relied on Python’s tarfile.extractall without the stronger filters introduced in recent Python releases. That omission...