CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13

🗓️ 16 Apr 2024 20:09:26Reported by GoogleType

osv🔗 osv.dev👁 3 Views

An arbitrary code injection in TensorFlow Keras below two point thirteen enables code execution with the application's permissions.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in TensorFlow Keras [CVE-2024-3660]	27 Sep 202422:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in TensorFlow Keras [CVE-2024-3660]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to keras-2.12.0-py2.py3-none-any.whl CVE-2024-3660	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary File Read, SSRF, and Code Execution Vulnerabilities in TensorFlow Keras Model Loading (v2.13) affects watsonx.data	8 Apr 202608:40	–	ibm
Huntr	Lambda Layer `safe_mode=None` Guard Bypass — Arbitrary Code Execution via `from_config()`	4 Apr 202620:35	–	huntr
GithubExploit	Exploit for CVE-2024-3660	15 Aug 202519:02	–	githubexploit
Circl	CVE-2024-3660	27 Jan 202519:23	–	circl
CNNVD	TensorFlow Keras 安全漏洞	16 Apr 202400:00	–	cnnvd
CVE	CVE-2024-3660	16 Apr 202420:09	–	cve
Cvelist	CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13	16 Apr 202420:09	–	cvelist

Source	Link
kb	www.kb.cert.org/vuls/id/253266
kb	www.kb.cert.org/vuls/id/253266
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3660.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3660

15 Jul 2026 01:48Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

EPSS0.01745