{"id":"CVE-2024-3660","aliases":["AZL-67629","CLSA-2026-1790928189","DEBIAN-CVE-2024-3660","EUVD-2024-1329","GHSA-x4wf-678h-2pmq","PYSEC-2026-369","UBUNTU-CVE-2024-3660"],"status":"published","title":"Arbitrary code injection vulnerability in Keras framework \u003c 2.13","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01745,"percentile":0.77949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2024-04-16T20:09:26Z","modified":"2026-10-28T02:31:12Z","exploits":[{"source":"pocgithub","id":"aaryanbhujang/CVE-2024-3660-PoC","title":"aaryanbhujang/CVE-2024-3660-PoC","date":"2025-08-15","url":"https://github.com/aaryanbhujang/CVE-2024-3660-PoC"}],"fixes":[{"ecosystem":"PyPI","package":"keras","fixed_in":["2.13.1rc0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1rc0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.11.0-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0.post3+tuxcare"}]}],"versions":["2.15.0","2.15.0.post1+tuxcare","2.15.0.post2+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+dfsg-3","2.3.1+dfsg2-1"]},{"source":"osv","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1rc0"}]}],"versions":["0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.10.0","2.10.0rc0","2.10.0rc1","2.11.0","2.11.0rc0","2.11.0rc1","2.11.0rc2","2.11.0rc3","2.12.0","2.12.0rc0","2.12.0rc1","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0rc0","2.6.0","2.6.0rc0","2.6.0rc1","2.6.0rc2","2.6.0rc3","2.7.0","2.7.0rc0","2.7.0rc2","2.8.0","2.8.0rc0","2.8.0rc1","2.9.0","2.9.0rc0","2.9.0rc1","2.9.0rc2"]},{"source":"osv","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1rc0"}]}],"versions":["0.2.0","0.3.0","0.3.1","0.3.2","0.3.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.10.0","2.10.0rc0","2.10.0rc1","2.11.0","2.11.0rc0","2.11.0rc1","2.11.0rc2","2.11.0rc3","2.12.0","2.12.0rc0","2.12.0rc1","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0rc0","2.6.0","2.6.0rc0","2.6.0rc1","2.6.0rc2","2.6.0rc3","2.7.0","2.7.0rc0","2.7.0rc2","2.8.0","2.8.0rc0","2.8.0rc1","2.9.0","2.9.0rc0","2.9.0rc1","2.9.0rc2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7-2","2.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1"]}],"products":[{"vendor":"google","product":"keras"},{"vendor":"keras","product":"keras"},{"vendor":"tensorflow","product":"keras"},{"vendor":"tensorflow","product":"tensorflow"}],"references":[{"url":"https://kb.cert.org/vuls/id/253266","tags":["x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.kb.cert.org/vuls/id/253266","tags":["x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3660","tags":["web","advisory"]},{"url":"https://github.com/keras-team/keras/compare/r2.12...r2.13","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x4wf-678h-2pmq","tags":["advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3660.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3660","tags":["advisory"]},{"url":"https://github.com/keras-team/keras","tags":["package"]},{"url":"https://pypi.org/project/keras","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-3660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3660","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-3660","title":"Arbitrary code injection vulnerability in Keras framework \u003c 2.13","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T20:09:26.22Z","modified":"2025-02-13T17:52:58.005Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.613319Z"}],"euvd":[{"id":"EUVD-2024-1329","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T20:09:26Z","modified":"2025-02-13T17:52:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-x4wf-678h-2pmq","title":"Keras code injection vulnerability","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:31:28Z","modified":"2024-08-02T16:07:46Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:57.422393Z"}],"nvd":[{"id":"CVE-2024-3660","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:15:08.603Z","modified":"2026-06-17T07:44:45.607Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:52.184911Z"}],"osv":[{"id":"CVE-2024-3660","title":"Arbitrary code injection vulnerability in Keras framework \u003c 2.13","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T20:09:26.22Z","modified":"2026-10-28T02:31:12.664341711Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-3660","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:15:08.603Z","modified":"2026-08-27T23:04:40.827903089Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"GHSA-x4wf-678h-2pmq","title":"Keras code injection vulnerability","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:31:28Z","modified":"2026-06-29T12:26:45.319075774Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"PYSEC-2026-369","title":"Keras code injection vulnerability","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2026-06-29T11:50:39.628931Z","modified":"2026-07-01T20:22:55.083321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2024-3660","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:15:00Z","modified":"2025-10-24T05:06:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"AZL-67629","title":"CVE-2024-3660 affecting package keras 2.11.0-3","description":"A arbitrary code injection vulnerability in TensorFlow's Keras framework (\u003c2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.","status":"published","published":"2024-04-16T21:15:08Z","modified":"2026-04-21T04:38:13.394537Z","updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CLSA-2026-1790928189","title":"TuxCare security update for keras (4 CVEs)","description":"TuxCare rebuilt keras to address 4 CVEs. Fixed in 2.15.0.post3+tuxcare.","status":"published","published":"2026-10-02T08:03:09Z","modified":"2026-10-27T13:43:13.403546741Z","updated_at":"2026-11-02T15:43:48.65893Z"}]}}