CVE-2024-55459

unknown

Published 2025-01-08 · Modified 2026-05-21

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2

—

VIR risk

—

Description

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-55459

OS impact

OS	Version	Status	Fixed in
debian	bullseye	affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	keras	`<=3.7.0`

References

https://nvd.nist.gov/vuln/detail/CVE-2024-55459
https://github.com/keras-team/keras
https://github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py#L115
https://keras.io
https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
https://security-tracker.debian.org/tracker/CVE-2024-55459

Verify integrity in audit chain (admin only). AS-IS.