Cyber Resilience

CVE-2024-3660

CriticalRCE

Published: 16 April 2024

Published
16 April 2024
Modified
23 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-3660 is a critical-severity Code Injection (CWE-94) vulnerability in Keras Keras. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Embedded Payloads (T1027.009); ranked in the top 40.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Deep Learning Frameworks; in the Supply Chain and Deployment risk domain; MITRE ATLAS techniques in scope: AI Supply Chain Compromise (AML.T0010).

EU & UK References

Vulnerability details

A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

CWE(s)
CWE-94

AI Security AnalysisAI

AI Category
Deep Learning Frameworks
Risk Domain
Supply Chain and Deployment
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
TensorFlow and Keras are core deep learning frameworks for building, training, and deploying ML models. The vulnerability specifically affects Keras Lambda layers in TensorFlow-based models, enabling arbitrary code execution during model loading.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1027.009 Embedded Payloads Stealth
Adversaries may embed payloads within other files to conceal malicious content from defenses.
attack.mitre.org →
T1059.006 Python Execution
Adversaries may abuse Python commands and scripts for execution.
attack.mitre.org →
T1195.002 Compromise Software Supply Chain Initial Access
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

CVE-2024-3660 enables embedding arbitrary Python code payloads in Keras models via Lambda layers (T1027.009, T1059.006), facilitating supply chain compromise by trojanizing and redistributing models (T1195.002), and exploitation for client-side code execution upon model loading (T1203).

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0010: AI Supply Chain Compromise

Affected Assets

keras
keras
≤ 2.13.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-34 Non-modifiable Executable Programs
addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

SC-44 Detonation Chambers
addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

SI-10 Information Input Validation
addresses: CWE-94

Validates inputs used in dynamic code generation to block injected directives.

SI-16 Memory Protection
addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.

References