thealgorithms/python

keras 3.9.2

10 advisories. Fixed in 3.11.0.

How it can be abusedAn attacker could trick a developer into loading a malicious model file, and Keras would run hidden code from that file even when safe mode is on. In this repo Keras is only a listed dependency for educational algorithm examples; nothing loads or serves models, so only a developer who manually loaded an untrusted model file outside the repo's normal workflow would be affected.

• highGHSA-36fq-jgmw-4r9cKeras is vulnerable to Deserialization of Untrusted Data
• highGHSA-36rr-ww3j-vrjvThe Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
• highGHSA-3m4q-jmj6-r34qKeras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
• highGHSA-4f3f-g24h-fr8mKeras has an untrusted deserialization vulnerability
• highGHSA-5gwj-m78q-7pq3Keras: Lambda deserialization can bypass safe mode and execute code
• highGHSA-c9rc-mg46-23w3Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
• highGHSA-hjqc-jx6g-rwp9Keras Directory Traversal Vulnerability
• highGHSA-hqp4-2352-xf5rKeras archive extraction utilities allow path traversal and arbitrary file writes
• highGHSA-mgx6-5cf9-rr43Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)
• highGHSA-v2w2-w228-c444Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

lxml 5.4.0

1 advisory. Fixed in 6.1.0.

How it can be abusedAn attacker could trick a program into parsing a malicious XML file that reads local files from the machine and leaks them. In this repo, lxml is not meaningfully used and there is no service processing untrusted XML, so only someone running the code on hostile XML files would be exposed.

• highGHSA-vfmq-68hx-4jfwlxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

pillow 11.2.1

14 advisories. Fixed in 12.3.0.

How it can be abusedThese bugs only matter if the code loads untrusted image files from outside sources. This repo is a set of standalone teaching scripts with no server or deployment target, so anyone running its examples processes their own local files and is not exposed to an attacker.

• highGHSA-45hq-cxwh-f6vcPillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
• highGHSA-5x94-69rx-g8h2Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
• highGHSA-62p4-gmf7-7g93Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
• highGHSA-6r8x-57c9-28j4Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
• highGHSA-8v84-f9pq-wr9xPillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
• highGHSA-9hw9-ch79-4vh6Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
• highGHSA-cfh3-3jmp-rvhcPillow affected by out-of-bounds write when loading PSD images
• highGHSA-jjj6-mw9f-p565Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
• highGHSA-phj9-mv4w-65pmPillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
• highGHSA-pwv6-vv43-88grPillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
• highGHSA-vjc4-5qp5-m44jPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
• highGHSA-whj4-6x5x-4v2jFITS GZIP decompression bomb in Pillow
• highGHSA-xg8h-j46f-w952Pillow vulnerability can cause write buffer overflow on BCn encoding
• highGHSA-xj96-63gp-2gmrPillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

soupsieve 2.7

2 advisories. Fixed in 2.8.4.

How it can be abusedThis library is used by BeautifulSoup to parse CSS selectors, and a malicious selector string could hang or exhaust memory of whatever process runs it. In this repo it is only an indirect developer tool with no server or user input, so no real attacker path exists.

• highGHSA-2wc2-fm75-p42xSoup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
• highGHSA-836r-79rf-4m37Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

urllib3 2.4.0

4 advisories. Fixed in 2.6.0.

How it can be abusedAn attacker who controls a web server that the code fetches data from could send a tiny response that expands enormously when decompressed, freezing or crashing the program, or trick it into forwarding sensitive headers to another site during redirects. In this repo, which is a library of offline educational algorithms with no network-facing code, urllib3 is only pulled in indirectly by developer tools, so real users of the algorithms are not affected.

• highGHSA-2xpw-w6gg-jr37urllib3 streaming API improperly handles highly compressed data
• highGHSA-38jv-5279-wg99Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
• highGHSA-gm62-xv2j-4w53urllib3 allows an unbounded number of links in the decompression chain
• highGHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects