CVE-2025-12638 — UNKNOWN AI Security Vulnerability

CISO Take

Keras 3.11.3 has a path traversal vulnerability in get_file() that enables arbitrary file writes via crafted tar archives, bypassing the library's own safety filter through a PATH_MAX symlink resolution bug. Any ML training pipeline or data science environment that fetches external datasets or model weights using Keras is at risk of remote code execution. Patch immediately or restrict get_file() calls to verified internal artifact registries until patched.

Risk Assessment

HIGH risk for organizations with automated ML pipelines that pull external artifacts. The PATH_MAX symlink bypass defeats Keras's built-in filter_safe_paths() check, making exploitation reliable and not dependent on a race condition. Attack surface is large because downloading pre-trained weights and public datasets via get_file() is a standard Keras workflow. If training runs as a privileged user or in a shared MLOps environment, the blast radius extends to lateral movement and full system compromise.

Severity & Risk

CVSS 3.1

N/A

EPSS

0.0%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Recommended Action

6 steps

Upgrade Keras to the patched version (fix is adding filter='data' to tarfile.extractall()).
If patching is blocked, audit all calls to keras.utils.get_file() and restrict to downloads from internal, checksum-verified artifact registries only.
Run training workloads in isolated containers with read-only host mounts and least-privilege write permissions.
Enable filesystem integrity monitoring (Falco, AIDE) on training nodes — alert on writes outside ~/.keras/ cache during extraction.
Pin Keras versions explicitly in requirements files and verify checksums in your supply chain pipeline.
In CI/CD, sandbox model download steps away from sensitive mounts before extraction.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Supply Chain Code Execution Framework Training Data AML.T0002.000 - Datasets AML.T0010.001 - AI Software AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0011.001 - Malicious Package AML.T0018.002 - Embed Malware

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity Article 15 - Accuracy, robustness, and cybersecurity

ISO 42001

A.10.1 - AI system technical security A.6.2.3 - AI supply chain risk management

NIST AI RMF

GOVERN-1.2 - Risk Tolerance and Prioritization MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems MANAGE-2.2 - Risk Treatment

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-12638?

Keras 3.11.3 has a path traversal vulnerability in get_file() that enables arbitrary file writes via crafted tar archives, bypassing the library's own safety filter through a PATH_MAX symlink resolution bug. Any ML training pipeline or data science environment that fetches external datasets or model weights using Keras is at risk of remote code execution. Patch immediately or restrict get_file() calls to verified internal artifact registries until patched.

Is CVE-2025-12638 actively exploited?

No confirmed active exploitation of CVE-2025-12638 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-12638?

1. Upgrade Keras to the patched version (fix is adding filter='data' to tarfile.extractall()). 2. If patching is blocked, audit all calls to keras.utils.get_file() and restrict to downloads from internal, checksum-verified artifact registries only. 3. Run training workloads in isolated containers with read-only host mounts and least-privilege write permissions. 4. Enable filesystem integrity monitoring (Falco, AIDE) on training nodes — alert on writes outside ~/.keras/ cache during extraction. 5. Pin Keras versions explicitly in requirements files and verify checksums in your supply chain pipeline. 6. In CI/CD, sandbox model download steps away from sensitive mounts before extraction.

What systems are affected by CVE-2025-12638?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, transfer learning workflows, MLOps CI/CD pipelines, data preprocessing pipelines, model serving.

What is the CVSS score for CVE-2025-12638?

No CVSS score has been assigned yet.

Technical Details

NVD Description

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.

Exploitation Scenario

An adversary publishes a weaponized dataset or model weights archive to a public repository (HuggingFace, Kaggle, public S3). The archive contains a symlink chain crafted to exceed PATH_MAX during extraction. A victim's automated training pipeline calls keras.utils.get_file() — the standard pattern for fetching benchmarks or fine-tuning weights. Keras runs filter_safe_paths() pre-extraction, but the PATH_MAX bug causes symlink resolution to fail silently, bypassing the check. During tarfile.extractall(), files land at attacker-controlled paths: overwriting ~/.bashrc, SSH authorized_keys, cron jobs, or dropping a backdoor into a Python site-packages directory. In shared MLOps platforms where training jobs run on multi-tenant GPU clusters, this becomes a privilege escalation and lateral movement vector across tenant boundaries.