CVE-2025-1550
published 2025-03-11CVE-2025-1550: The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
2.80%
84.8th percentile
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keras | — | — |
| keras | >= 3.0.0 < 3.8.0 | 3.8.0 | |
| keras | keras | >= 3.0.0 < 3.8.0 | 3.8.0 |
| keras | keras | >= 3.0.0 < 3.11.0 | 3.11.0 |
| keras | keras | >= 3.0.0 < 3.9.0 | 3.9.0 |
| msrc | azl3_keras_3.3.3-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_mozjs_102.15.1-1_on_azure_linux_3.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
rule CVE_2025_1550_malicious_keras_config { strings: $class_name = "\"class_name\": \"function\"" $module_os = "\"module\": \"os\"" $fn_system = "\"function_name\": \"system\"" condition: all of them }- →Monitor for .keras archive files containing a config.json with 'class_name': 'function' entries specifying arbitrary 'module' and 'function_name' fields — this is the core deserialization gadget used to achieve RCE. ↗
- →Detect Lambda layers in Keras config.json with a 'function' object whose 'module' is set to 'os' and 'function_name' is set to 'system' — this is the specific payload pattern used in the PoC exploit. ↗
- →Alert on processes spawning child processes (e.g., shell commands) from within a Python process that has loaded a .keras model file — indicates successful exploitation of the deserialization vulnerability. ↗
- →Inspect .keras ZIP archives (they are ZIP files) for a config.json containing 'class_name': 'Lambda' layers with embedded 'function' deserialization objects referencing non-Keras Python modules. ↗
- →The exploit is effective even when safe_mode=True is set; do not rely on safe_mode as a security control for untrusted .keras files. ↗
- →Watch for creation of unexpected files in /tmp (e.g., /tmp/pwned_by_keras) immediately following a keras load_model() call — a common canary indicator of exploitation. ↗
- ·safe_mode=True does NOT prevent exploitation — the vulnerability bypasses this protection entirely via manually crafted .keras archives. ↗
- ·Affected versions are Keras <= 2.15 and TensorFlow versions using unsafe deserialization paths prior to the April 2025 patch. ↗
- ·The attack vector is client-side: exploitation occurs at model load time via load_model() or model_from_json(), not over a network service — any system loading untrusted .keras files is at risk. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.3HIGH
osv7.3HIGH
vendor_msrc9.8CRITICAL
vendor_debian7.3LOW
vendor_redhat7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
ghsa·2025-08-12·CVSS 7.3
CVE-2025-8747 [HIGH] CWE-502 Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
### Summary
It is possible to bypass the mitigation introduced in response to [CVE-2025-1550](https://github.com/keras-team/keras/security/advisories/GHSA-48g7-3x6r-xfhp), when an untrusted Keras v3 model is loaded, even when “safe_mode” is enabled, by crafting malicious arguments to built-in Keras modules.
The vulnerability is exploitable on the default configuration and does not depend on user input (just requires an untrusted model to be loaded).
### Impact
| Type | Vector |Impact|
| -------- | ------- | ------- |
|Unsafe deserialization |Client-Side (when loading untrusted model)|Arbitrary file overwrite. Can lead to Arbitrary code execution in many cases.|
### Details
Keras’ [safe_mode](https://www.ten
OSV
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
osv·2025-08-12·CVSS 7.3
CVE-2025-8747 [HIGH] Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
### Summary
It is possible to bypass the mitigation introduced in response to [CVE-2025-1550](https://github.com/keras-team/keras/security/advisories/GHSA-48g7-3x6r-xfhp), when an untrusted Keras v3 model is loaded, even when “safe_mode” is enabled, by crafting malicious arguments to built-in Keras modules.
The vulnerability is exploitable on the default configuration and does not depend on user input (just requires an untrusted model to be loaded).
### Impact
| Type | Vector |Impact|
| -------- | ------- | ------- |
|Unsafe deserialization |Client-Side (when loading untrusted model)|Arbitrary file overwrite. Can lead to Arbitrary code execution in many cases.|
### Details
Keras’ [safe_mode](https://www.ten
OSV
Arbitrary Code Execution via Crafted Keras Config for Model Loading
osv·2025-03-11·CVSS 7.3
CVE-2025-1550 [HIGH] Arbitrary Code Execution via Crafted Keras Config for Model Loading
Arbitrary Code Execution via Crafted Keras Config for Model Loading
### Impact
The Keras `Model.load_model` function permits arbitrary code execution, even with `safe_mode=True`, through a manually constructed, malicious `.keras` archive. By altering the `config.json` file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
### Patches
This problem is fixed starting with version `3.9`.
### Workarounds
Only load models from trusted sources and model archives created with Keras.
### References
- https://www.cve.org/cverecord?id=CVE-2025-1550
- https://github.com/keras-team/keras/pull/20751
GHSA
Arbitrary Code Execution via Crafted Keras Config for Model Loading
ghsa·2025-03-11·CVSS 7.3
CVE-2025-1550 [HIGH] CWE-94 Arbitrary Code Execution via Crafted Keras Config for Model Loading
Arbitrary Code Execution via Crafted Keras Config for Model Loading
### Impact
The Keras `Model.load_model` function permits arbitrary code execution, even with `safe_mode=True`, through a manually constructed, malicious `.keras` archive. By altering the `config.json` file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
### Patches
This problem is fixed starting with version `3.9`.
### Workarounds
Only load models from trusted sources and model archives created with Keras.
### References
- https://www.cve.org/cverecord?id=CVE-2025-1550
- https://github.com/keras-team/keras/pull/20751
OSV
CVE-2025-1550: The Keras Model
osv·2025-03-11·CVSS 7.3
CVE-2025-1550 [HIGH] CVE-2025-1550: The Keras Model
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Microsoft
Arbitrary Code Execution via Crafted Keras Config for Model Loading
vendor_msrc·2025-03-11·CVSS 9.8
CVE-2025-1550 [HIGH] CWE-94 Arbitrary Code Execution via Crafted Keras Config for Model Loading
Arbitrary Code Execution via Crafted Keras Config for Model Loading
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Google: Google
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference:
Red Hat
keras: Arbitrary Code Execution via Crafted Keras Config for Model Loading
vendor_redhat·2025-03-11·CVSS 7.3
CVE-2025-1550 [HIGH] CWE-94 keras: Arbitrary Code Execution via Crafted Keras Config for Model Loading
keras: Arbitrary Code Execution via Crafted Keras Config for Model Loading
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
A flaw was found in Keras. This vulnerability allows arbitrary code execution via a maliciously crafted .keras archive that manipulates the config.json file to load and execute arbitrary Python modules and functions, even with safe_mode=True.
Statement: None of the Red Hat Products and Services are impacted by this vulnerability.
Mitigation: In order to reduce the success
Debian
CVE-2025-1550: keras - The Keras Model.load_model function permits arbitrary code execution, even with ...
vendor_debian·2025·CVSS 7.3
CVE-2025-1550 [HIGH] CVE-2025-1550: keras - The Keras Model.load_model function permits arbitrary code execution, even with ...
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Scope: local
bullseye: resolved
Microsoft
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion
vendor_msrc·2024-02-13·CVSS 6.1
CVE-2024-1550 [MEDIUM] CWE-1021 A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this
No detection rules found.
Exploit-DB
Keras 2.15 - Remote Code Execution (RCE)
exploitdb·2025-07-16·CVSS 7.3
CVE-2025-1550 [HIGH] Keras 2.15 - Remote Code Execution (RCE)
Keras 2.15 - Remote Code Execution (RCE)
---
#!/usr/bin/env python3
# Exploit Title: Keras 2.15 - Remote Code Execution (RCE)
# Author: Mohammed Idrees Banyamer
# Instagram: @banyamer_security
# GitHub: https://github.com/mbanyamer
# Date: 2025-07-09
# Tested on: Ubuntu 22.04 LTS, Python 3.10, TensorFlow/Keras <= 2.15
# CVE: CVE-2025-1550
# Type: Remote Code Execution (RCE)
# Platform: Python / Machine Learning (Keras)
# Author Country: Jordan
# Attack Vector: Malicious .keras file (client-side code execution via deserialization)
# Description:
# This exploit abuses insecure deserialization in Keras model loading. By embedding
# a malicious "function" object inside a .keras file (or config.json), an attacker
# can execute arbitrary system commands as soon as the model is loaded using
# `
Nuclei
Keras Model.load_model - Arbitrary Code Execution
nuclei·CVSS 7.3
CVE-2025-1550 [HIGH] Keras Model.load_model - Arbitrary Code Execution
Keras Model.load_model - Arbitrary Code Execution
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
Template:
id: CVE-2025-1550
info:
name: Keras Model.load_model - Arbitrary Code Execution
author: nukunga[seunghyeonJeon]
severity: critical
description: |
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Pyt
2025-03-11
Published