CVE-2021-35958: Google Tensorflow

Critical severity, CVSS 9.1. EPSS: 1.9% chance of exploitation in the next 30 days.

TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives

Affected products

• Google Tensorflow: up to and including 2.5.0

Published 2021-06-30. Last modified 2026-06-17.