Keras CVE-2025-49655

Exploitation requires the victim to load an attacker-supplied Keras model file (local or remote URL) containing a TorchModuleWrapper class, which triggers torch.load() during from_config() deserialization in Keras 3.11.0, 3.11.1, or 3.11.2. The defining condition is that this path executes even with safe_mode ENABLED (the default), so the usual safeguard does not stop it. Limiting factors: the attack needs the victim to obtain and deliberately load the malicious .keras file (user interaction), and only the narrow version band 3.11.0-3.11.2 is affected - 3.11.3 and later raise a ValueError in safe mode, and earlier branches are unaffected.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this CRITICAL, and CWE-502 deserialization leading to RCE is a genuinely dangerous class. However, the signals partially conflict: the NVD vector marks UI:N, yet the description states the code only runs 'when loaded' - i.e. a victim must actively load an attacker-supplied Keras model file - which is user interaction and materially lowers real-world likelihood versus a true no-interaction network RCE. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT listed in CISA KEV and no public exploit was flagged in the input, so there is no confirmation of active exploitation; the referenced HiddenLayer security advisory indicates researcher attention but is not a POC signal. The most security-relevant fact is that exploitation bypasses Keras safe_mode, the DEFAULT protection users rely on - this elevates priority for anyone loading untrusted .keras files. Net assessment: a real, high-priority issue for ML pipelines that ingest third-party models, but the required user interaction and narrow affected range (3.11.0-3.11.2) make it closer to a targeted/social-engineering vector than mass-exploitable network RCE. The UI:N in the NVD vector should be verified with the vendor, as it likely overstates the no-interaction nature of the flaw.

An attacker publishes a trojanized model to a model hub or sends it directly, embedding a TorchModuleWrapper that invokes torch.load(). When a victim loads the file with Keras 3.11.0-3.11.2 using keras.saving.load_model() - even with safe_mode enabled - the malicious payload deserializes and executes arbitrary code on the victim's host. No public exploit was identified in the input, though a HiddenLayer advisory describes the issue.