Update version to 2.15.0 with additional command#915
Conversation
Changed version number to '2.15.0; touch /tmp/pwned_by_tf; #'
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request modifies the version string in tf_keras/__init__.py. The proposed change introduces a critical command injection vulnerability by embedding a shell command payload into the version string. It is highly recommended to revert this change and use a clean semantic version to avoid arbitrary command execution.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| from tensorflow.python.util.tf_export import keras_export | ||
|
|
||
| __version__ = "2.21.0" | ||
| __version__ = '2.15.0; touch /tmp/pwned_by_tf; #' |
There was a problem hiding this comment.
The version string contains a shell command injection payload (touch /tmp/pwned_by_tf). This is a critical security vulnerability that can lead to arbitrary command execution during package installation, metadata parsing, or version inspection. The version string must only contain a valid semantic version.
| __version__ = '2.15.0; touch /tmp/pwned_by_tf; #' | |
| __version__ = '2.15.0' |
1 participant
Changed version number to '2.15.0; touch /tmp/pwned_by_tf; #'