Deserialization bug in TensorFlow machine learning framework allowed arbitrary code execution

According to an advisory on GitHub, both TensorFlow and Keras, a wrapper library for TensorFlow, used an unsafe function to deserialize YAML-encoded machine learning models.