Listen to this Post
The vulnerability stems from Keras and TensorFlow honoring HDF5 “external storage” and “ExternalLink” features when loading model weights via `load_weights()` or `load_model()` . Despite “safe mode” being enabled to block object deserialization attacks, the weight loading path remains unprotected. When a victim loads a malicious `.weights.h5` file (or a `.keras` archive containing such weights), the HDF5 parser follows external references pointing to arbitrary files on the host system . The bytes from targeted files (e.g., /etc/passwd, SSH private keys) are read directly into model tensors such as Dense layer biases. These stolen contents become observable through inference outputs—for example, by passing zero vectors to the model and extracting the returned values. Alternatively, if the victim re-saves the model, the leaked data becomes embedded in a new artifact that may be shared publicly. The issue affects the latest stack (TensorFlow 2.20.0, Keras 3.11.3) and bypasses all existing safety flags because it exploits HDF5’s native external data feature rather than Python deserialization . Syscall tracing confirms the process opens and reads the targeted host files during weight loading, with the exact contents appearing in weight tensors . This constitutes CWE-200 (Information Exposure) and CWE-73 (External Control of File Name) .
Platform: TensorFlow/Keras
Version: 2.20.0/3.11.3
Vulnerability: Information Disclosure
Severity: Medium
Date: 2025-10-19
Prediction: 2025-11-30
What Undercode Say:
Analytics:
Environment verification commands
python -m pip install -U tensorflow==2.20.0 keras==3.11.3 h5py==3.15.1 numpy==2.3.4
strace -f -e trace=open,openat,read python weights_external_demo.py 2>&1 | grep -E "/etc/(hosts|passwd|hostname)"
Check if safe_mode protects against this (it doesn't)
python3 -c "
import tensorflow as tf
import numpy as np
model = tf.keras.Sequential([tf.keras.layers.Dense(1, input_shape=(1,))])
try:
Attempt load with safe_mode=True - still vulnerable
model.load_weights('malicious_weights.h5')
print('VULNERABLE: safe_mode does not block external storage')
except Exception as e:
print(f'Protected: {e}')
"
Detect malicious HDF5 files before loading
python3 -c "
import h5py
import sys
def check_h5_external(filename):
with h5py.File(filename, 'r') as f:
def visitor(name, obj):
if hasattr(obj, 'external') and obj.external:
print(f'EXTERNAL DATASET FOUND: {name} -> {obj.external}')
if isinstance(obj, h5py.ExternalLink):
print(f'EXTERNAL LINK FOUND: {name} -> {obj.filename}:{obj.path}')
f.visititems(visitor)
check_h5_external(sys.argv[bash])
" malicious_weights.h5
Monitor file access during model loading
sudo inotifywait -m -r -e open,access /etc/passwd /etc/hosts /etc/hostname &
python -c "import tensorflow as tf; tf.keras.models.load_model('malicious.keras')"
How Exploit:
Create HDF5 file with dataset using `external=[(target_file, offset, size)]` or ExternalLink pointing to sensitive files. Victim loads weights; bytes flow into model tensors .
Protection from this CVE:
Reject untrusted .h5/.keras files. Pre-scan with `h5py` for external references. Use `npz` format. Load inside sandboxed container .
Impact:
Leakage of any readable file (credentials, configs, system files) via model outputs or re-saved artifacts .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
