Vulnerability · Published Mar 11, 2025 · Assigned by Google
CVE-2025-1550Arbitrary Code Execution via Crafted Keras Config for Model Loading
High 7.3
In plain English
A high-severity code injection in Keras from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | keras | 3.9.0 | GHSA-48g7-3x6r-xfhp |
| PyPI | keras | 3.8.0 | PYSEC-2025-122 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H