CVE-2025-8747

CWE-502 — Deserialization of Untrusted Data7 documents6 sources
Severity
8.6HIGH
EPSS
0.0%
top 99.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google KerasKeras Keras
Timeline
PublishedAug 11
Latest updateAug 12

Description

A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages3 packages

▶PyPIkeras3.0.0 — 3.11.0
▶NVDkeras/keras3.0.0 — 3.10.0
▶CVEListV5google/keras3.0.0 — 3.10.0

🔴Vulnerability Details

4
GHSA
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality↗2025-08-12
▶
OSV
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality↗2025-08-12
▶
OSV
CVE-2025-8747: A safe mode bypass vulnerability in the `Model↗2025-08-11
▶
CVEList
Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.↗2025-08-11
▶

📋Vendor Advisories

2
Microsoft
Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.↗2025-08-12
▶
Debian
CVE-2025-8747: keras - A safe mode bypass vulnerability in the `Model.load_model` method in Keras versi...↗2025
▶
CVE-2025-8747 (HIGH CVSS 8.6) | A safe mode bypass vulnerability in | cvebase.io