AVID-2026-R1574

Description

Vulnerability CVE-2024-55459

Details

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user’s machine via downloading a crafted tar file through the get_file function.

Reason for inclusion in AVID: CVE-2024-55459 describes a vulnerability in Keras 3.7.0 that allows arbitrary file write when downloading a crafted tar via the get_file function. Keras is a core AI framework used to build/train/deploy AI models, so this vulnerability concerns AI software stacks and dependencies. It is a security vulnerability (arbitrary file write) with explicit CVE and multiple references, providing sufficient signal for AVID curation. As the issue resides in a software dependency used in general-purpose AI systems, it is relevant to the GP AI supply chain.

References

• NVD entry
• https://github.com/keras-team/keras
• https://keras.io
• https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2025-01-08
• Version: 0.3.3
• AVID Entry