New challenge worth $15,000
hertschuh
@hertschuh
UNPROVEN
0 CVEs • 0 vulnerabilities • 8 fixes
Joined October 2025
Vulnerabilities Fixed
- Path Traversal in Keras Archive Extraction via CWD Validation Bypass Leading to Arbitrary File Write fix in keras-team / keras (Jun 9)
- Incomplete Fix for CVE-2026-1669: HDF5 External Storage File Disclosure in Legacy H5 Loading fix in keras-team / keras (May 26)
- model.weights.h5: h5py.ExternalLink at Group level silently followed during load_model(), bypassing CVE-2025-9905 fix — information disclosure from arbitrary HDF5 files fix in keras-team / keras (May 22)
- Infinite Loop Denial of Service via Circular Dependencies in Functional Model Deserialization fix in keras-team / keras (May 22)
- Path traversal via startswith() prefix confusion in is_path_in_dir (bypass of CVE-2025-12638 fix) fix in keras-team / keras (May 22)
- Arbitrary File Write via Path Traversal in Orbax Checkpoint Asset Dict Keys fix in keras-team / keras (May 21)
- Zip Slip path traversal in keras.utils.get_file(..., extract=True) archive extraction fix in keras-team / keras (May 1)
- Path Traversal vulnerability in keras using tar extract fix in keras-team / keras (Nov 3)