PT-2025-32526 · Keras+1 · Keras+1
Published
2025-01-01
·
Updated
2025-08-16
·
CVE-2025-8747
CVSS v4.0
8.6
High
| Vector | AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:A |
Name of the Vulnerable Software and Affected Versions:
Keras versions 3.0.0 through 3.10.0
Description:
A safe mode bypass vulnerability exists in the
Model.load model method. This allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive. The vulnerability bypasses the intended protection of the safe mode flag, which is designed to prevent the deserialization of unsafe lambda objects. This bypass is possible by reusing internal Keras functions, such as keras.utils.get file, to download remote files to a location controlled by the attacker, potentially leading to arbitrary file overwrites and, in many cases, remote code execution. The vulnerability is exploitable on the default configuration and does not require user input beyond loading an untrusted model.Recommendations:
Keras versions prior to 3.0.0 are not affected.
Keras version 3.0.0 through 3.10.0 are affected. As a temporary workaround, avoid loading
.keras models from untrusted sources.Exploit
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Keras