What is the CVSS score of CVE-2025-1550?

CVE-2025-1550 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.8%.

Which versions of Python are affected by CVE-2025-1550?

CVE-2025-1550 presents critical security risk, a code injection vulnerability rated CVSS 9.8.. A patch is available.

Is there a public PoC exploit available for CVE-2025-1550?

Yes, a public proof-of-concept exploit is available for CVE-2025-1550. Prioritise patching immediately. EPSS: 4.8%.

How to fix or mitigate CVE-2025-1550?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Python CVE-2025-1550

CRITICAL

Code Injection (CWE-94)

2025-03-11 cve-coordination@google.com

GHSA-48g7-3x6r-xfhp

RCE Python Red Hat

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

PoC Detected

Jul 31, 2025 - 16:55 vuln.today

Public exploit code

Patch released

Jul 31, 2025 - 16:55 nvd

Patch available

CVE Published

Mar 11, 2025 - 09:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on keras (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.

AnalysisAI

Keras Model.load_model can execute arbitrary code even with safe_mode=True by manipulating the config.json inside a .keras archive. An attacker can specify arbitrary Python modules and functions to be loaded during model deserialization. PoC available, patch available.

Technical ContextAI

The .keras archive format includes a config.json that specifies which Python classes to instantiate. While safe_mode=True restricts certain operations, the validation is insufficient (CWE-94) – an attacker can reference arbitrary Python modules and functions with controlled arguments in the config.

Affected ProductsAI

Keras (versions before the fix)

RemediationAI

Update Keras to the latest patched version. Never load models from untrusted sources, even with safe_mode=True. Validate model provenance before loading.