PT-2025-44268 · Tensorflow+1 · Keras+1

Published 2025-10-29 · Updated 2025-12-17 · CVE-2025-12058

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Keras (affected versions not specified)

Description The Keras Model.load model method is susceptible to arbitrary local file loading and Server-Side Request Forgery (SSRF), even when safe mode=True is enabled. This issue arises from the handling of the StringLookup layer during model loading from a crafted .keras archive. The StringLookup layer's constructor accepts a vocabulary argument that can specify local or remote file paths. An attacker can embed a local path within the StringLookup layer's configuration in a malicious .keras file. Upon loading the model, Keras attempts to read the content of the specified local file, potentially exposing arbitrary local files on the system. Furthermore, Keras uses tf.io.gfile for file operations, which supports remote filesystem handlers and HTTP/HTTPS protocols, enabling an attacker to fetch content from arbitrary network endpoints, resulting in an SSRF condition. The intended security mitigation, safe mode=True, does not adequately restrict external path loading.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

SSRF

Weakness Enumeration

CWE-502

CWE-918

Related Identifiers

AZL-69021

AZL-69583

CVE-2025-12058

GHSA-MQ84-HJQX-CWF2

GHSA-QG93-C7P6-GG7F

OESA-2025-2689

OESA-2025-2690

OESA-2025-2691

Affected Products

Debian

Keras

References · 26

• https://osv.dev/vulnerability/OESA-2025-2690 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69021 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq84-hjqx-cwf2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12058 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12058 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12058 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12058 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12058 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2689 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-12058 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2691 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12058 · Vendor Advisory
• https://github.com/keras-team/keras · Note
• https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f · Note