CVSS 4.0
7.3 highCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCVE-2025-1550
High (7.3) in keras keras. EPSS 2.6% chance of exploitation in the next 30 days. Fixed in keras 3.8.0, 3.9.0.
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- keras:keras
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-48g7-3x6r-xfhp | PyPI | keras | >=3.0.0 <3.9.0 | 3.9.0 |
| PYSEC-2025-122 | PyPI | keras | >=3.0.0 <3.8.0 | 3.8.0 |