Gabriele Digregorio

**Name of the Vulnerable Software and Affected Versions** Google Messages for Wear OS (affected versions not specified) **Description** A flaw exists in Google Messages for Wear OS where the handling of `ACTION SENDTO` intents using `sms:`, `smsto:`, `mms:`, and `mmsto:` Uniform Resource Identifier (URI) schemes is improperly configured. This allows an attacker who can invoke an Android intent to send messages on a user’s behalf to any recipient without requiring user interaction or permissions. The issue enables the silent and unauthorized transmission of messages from a compromised Wear OS device. The vulnerability was discovered in March 2025 and patched in May 2025. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keras (affected versions not specified) **Description** The `Model.load model` method can be exploited to achieve arbitrary code execution, even when `safe mode` is enabled. This is possible by creating a specially crafted `.h5` or `.hdf5` model archive that, when loaded, triggers the execution of arbitrary code. The vulnerability stems from the fact that the `safe mode=True` option is not honored when reading `.h5` archives. The issue involves the `Lambda` layer feature of Keras, which allows arbitrary Python code in the form of pickled code to be included within the model archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keras (affected versions not specified) **Description** The `Model.load model` method is susceptible to arbitrary code execution, even when `safe mode` is enabled. A specially crafted `.keras` model archive containing a modified `config.json` file can trigger the execution of arbitrary code. The `config.json` file invokes `keras.config.enable unsafe deserialization()` to disable safe mode. Subsequently, a `Lambda` layer with arbitrary Python code, serialized using pickling, can be included within the same archive to achieve code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keras versions 3.0.0 through 3.7.9 **Description** The Keras `Model.load model` function allows for arbitrary code execution, even when `safe mode` is enabled. This occurs through a maliciously crafted `.keras` archive. An attacker can modify the `config.json` file within the archive to specify arbitrary Python modules and functions, along with their arguments, which are then loaded and executed during model loading. The vulnerability stems from insufficient validation during model loading, specifically within the handling of the `config.json` file. **Recommendations** Update to Keras version 3.9 or later. Only load models from trusted sources.