Blackduck vulnerability reported in all the versions of Keras

[frnz123]

In Blackduck scan ,Keras package is reported as vulnerable with CVE ID =BDSA-2025-0107. can you please let us know in which release this fix will be given and when is the release date.

Issue description:
Keras is vulnerable to arbitrary file write due to a flaw in the get_file function. This could allow an attacker to write arbitrary files to the user's machine by downloading a crafted tar file.