Keras

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 10 Last 12 months 13 Lifetime Code execution 45 % Parsing/validation 25 % Access control 15 % Info disclosure 10 % Latest advisories Loading the feed Overview Keras is the high-level API most ML practitioners actually write against, and .keras and legacy .h5 model files are traded freely on Hugging Face, Kaggle and internal model registries. That trading is the attack surface: a safe_mode bypass turns "download a pretrained model" into remote code execution on the machine of every data scientist and every inference server that loads it, and unlike most library bugs the path needs no network position at all — just a model file someone was going to open anyway. Ten of its thirteen lifetime CVEs landed in the last twelve months, concentrated in exactly that class, which is the guard safe_mode was introduced to close and has repeatedly been bypassed on. Google prices both keras and tf-keras at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and it names both keras-team/keras and keras-team/tf-keras at TIER_OT1: a product vulnerability anywhere in either repository is accepted, at $101 to $3,133.70 Model persistence in every format the library reads or writes: the .keras archive, legacy HDF5 .h5 files, weights-only checkpoints, and the SavedModel export and import paths keras.saving end to end: config serialisation and deserialisation, custom-object registration and resolution, the safe_mode guard, and the layer graph rebuilt from a config the loader did not author The modelling API itself: keras.layers , keras.Model and the functional and sequential builders, keras.ops , activations, initialisers, constraints, losses, metrics and optimisers Multi-backend dispatch across the TensorFlow, JAX, PyTorch and NumPy backends, including anything reachable through only one of them keras.utils : get_file downloading and archive extraction, the dataset, image and text loading helpers, and the path handling around all of it Preprocessing and feature layers that parse user-supplied text, images or tabular values at run time rather than at model-build time Callbacks and the training loop, covering checkpoint writing, logging and the callbacks that reach the network during fit Repository configuration and the PyPI release pipeline for keras and tf-keras , which Google prices under its separate supply-chain category Out of scope Loading a model from an untrusted source with safe_mode=False , which the project documents as unsafe and places out of scope Adversarial-example, model-poisoning and other ML-robustness research, which the program routes to the Google AI VRP rather than the OSS VRP Backend framework bugs that actually belong to TensorFlow, JAX or PyTorch rather than to Keras Notebook and tutorial code shipped alongside the library Application-level misuse of the saving API by the caller Any other repository in the keras-team org, which the tier file does not list and which pays nothing for a product vulnerability after the April 2026 rules update Defects that only reproduce on a release the projects no longer ship, since the program covers the latest versions Reports filed by anyone other than the finder: Google wants the submission through bughunters.google.com under the researcher's own identity, and it does not pay Google or Google Partner employees Rewards to researchers on a sanctions list, in a sanctioned territory, or located in Russia or Belarus, which Google states it cannot issue Most-valued findings A safe_mode bypass that reaches arbitrary code execution while the guard is enabled: code execution is 45% of Keras's profile, ten of its thirteen CVEs are this shape, and it is the class that reaches the top of the $3,133.70 band because it fires on a model file a victim intended to load Lambda layer or custom-object resolution that resolves to a callable the archive chose rather than one the loading process registered Config-driven layer reconstruction that instantiates a class outside the allowlist, which is the reconstruction step the guard is meant to constrain A path that only exists on one backend, since multi-backend dispatch means a bypass closed on the TensorFlow route may still be open through JAX or PyTorch keras.utils.get_file extraction flaws such as path traversal out of the destination directory, which is the access-control share landing as arbitrary file write Legacy HDF5 loading defects, because older .h5 checkpoints circulate widely and are loaded by the same modern code path Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Keras and tf-keras are both rated TIER_OT1, so a finding has to land in one of those two repositories, and product vulnerabilities cap at $3,133.70 The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering the repository or release pipeline rather than a code vulnerability in the repo Loading a model with safe_mode=False is out of scope: turning the guard off is documented as unsafe, so the finding has to defeat the guard while it is on Google may route your report to its AI VRP instead of handling it under the open-source rules, which changes who assesses it and against which criteria The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with fixes landing in the keras and tf-keras repositories and an advisory published against the PyPI packages: the recent CVE stream has followed that pattern closely. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail: a live safe_mode bypass is immediately weaponisable against any public model hub. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability