Cloudanix VulnDB

CVE-2025-9906

None

Keras is vulnerable to Deserialization of Untrusted Data

CVSS

—

EPSS

0.2%

Published

Sep 19, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in the popular Keras machine-learning library lets attackers run harmful code on your computers simply by getting you to open a specially made model file, even when safety settings are turned on.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Remote Code Execution
Component
Library
Class
Deserialization
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The Keras Model.load_model method can be abused to achieve arbitrary code execution even when safe_mode=True by embedding a config.json that calls keras.config.enable_unsafe_deserialization followed by a Lambda layer containing pickled Python code inside a crafted .keras archive.

Why it matters to the business

Organizations that load untrusted Keras models risk full system compromise, data theft, or ransomware deployment on any machine or service that processes models, with elevated urgency for environments still running older Keras releases.

How an attack unfolds

An attacker prepares a malicious .keras archive containing a config.json that first invokes enable_unsafe_deserialization and a subsequent Lambda layer with arbitrary pickled code; the victim is then induced to call Model.load_model on the archive, triggering code execution.

How to fix it

Upgrade keras-team/keras to commit 7bf852c211ea41dc58bbc740c3fe64d091d37511 or later; for Debian 11 puppet packages upgrade to version 2.7.3-3 or newer; avoid loading models from untrusted sources and consider disabling model loading in high-security contexts until patched.

How to confirm the fix worked

Verify the installed Keras package reports a version containing commit 7bf852c211ea41dc58bbc740c3fe64d091d37511; test that loading a model with enable_unsafe_deserialization in its config now fails or is blocked; scan dependency manifests for the vulnerable commit hash.

Typical attack path

  1. Craft a .keras archive with a leading config.json that calls keras.config.enable_unsafe_deserialization
  2. Append a Lambda layer definition containing pickled arbitrary Python code
  3. Deliver the archive to the target via supply-chain, file share, or model repository
  4. Victim application invokes Model.load_model on the archive
  5. Unsafe deserialization executes the attacker-supplied code

How to detect it

Review application logs for calls to Model.load_model on files containing config.json entries with enable_unsafe_deserialization; inspect downloaded or received .keras archives for the presence of both a config.json invoking unsafe deserialization and a Lambda layer definition; correlate with process execution of python interpreters immediately following model loads.

What your security team should do

  • Immediately upgrade all Keras installations to the fixed commit or package versions listed above
  • Inventory and restrict locations where Model.load_model is called on externally supplied files
  • Add runtime checks or wrappers that reject archives containing enable_unsafe_deserialization calls
  • Monitor model-loading code paths with enhanced logging for the next 90 days

The record

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

Affected packages

Ecosystem Package Introduced Fixed
PyPI keras 0 3.11.0
Debian:11 keras 0 No fix

Related vulnerabilities