← Database

CVE-2021-35958

CRITICAL CVSS: 9.1 Published: 2021-06-30 Modified: 2026-06-17

Description

TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives

Affected Platforms

Google Tensorflow

Weakness Type

CWE-22

References