A vulnerability in the "TFSMLayer" class of the "keras" package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of ".keras" models, even when "safe_mode=True". This bypasses the security guarantees of "safe_mode" and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the "from_config()" method.