Vulnerability · Published Oct 17, 2025 · Assigned by HiddenLayer
CVE-2025-49655
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Keras from Keras. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | keras | 3.11.3 | GHSA-cvhh-q5g5-qprp |
| PyPI | keras | 3.11.3 | PYSEC-2026-368 |
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H