PyPI/keras CVE-2025-12058: medium 5.9, EPSS 0.25%

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

Action: Upgrade keras to 3.12.0 or later.

pip install keras==3.12.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1487
• nvd: CVE-2025-12058
• https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f
• https://github.com/keras-team/keras/pull/21751
• https://github.com/keras-team/keras/commit/61ac8c1e51862c471dee7b49029c356f55531487
• https://github.com/keras-team/keras
• https://www.cve.org/CVERecord?id=CVE-2025-12058
• https://pypi.org/project/keras
• https://github.com/advisories/GHSA-mq84-hjqx-cwf2

CVE-2025-12058 · published 2026-07-07T16:03:08.498075Z · modified 2026-07-07T17:57:32.006640385Z · JSON