CVE-2025-1550
CRITICAL
GHSA-48g7-3x6r-xfhp
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Analysis
Keras Model.load_model can execute arbitrary code even with safe_mode=True by manipulating the config.json inside a .keras archive. An attacker can specify arbitrary Python modules and functions to be loaded during model deserialization. PoC available, patch available.
Technical Context
The .keras archive format includes a config.json that specifies which Python classes to instantiate. While safe_mode=True restricts certain operations, the validation is insufficient (CWE-94) – an attacker can reference arbitrary Python modules and functions with controlled arguments in the config.
Affected Products
Keras (versions before the fix)
Remediation
Update Keras to the latest patched version. Never load models from untrusted sources, even with safe_mode=True. Validate model provenance before loading.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today