CVE-2025-1550: Arbitrary Code Execution via Crafted Keras Config for Model Loading
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-48g7-3x6r-xfhp. This link is maintained to preserve external references.
Original Description
The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Other sources
Impact
The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
Patches
This problem is fixed starting with version 3.9.
Workarounds
Only load models from trusted sources and model archives created with Keras.
References
- https://www.cve.org/cverecord?id=CVE-2025-1550 - https://github.com/keras-team/keras/pull/20751
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1550?
CVE-2025-1550 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-1550?
To fix CVE-2025-1550, update to the latest version of Keras that addresses this vulnerability.
What impact does CVE-2025-1550 have on Keras applications?
CVE-2025-1550 can allow an attacker to execute arbitrary Python code within Keras applications, compromising the integrity and security of the environment.
Is safe_mode effective against CVE-2025-1550?
No, safe_mode is ineffective in mitigating CVE-2025-1550 as the vulnerability can bypass it through malicious .keras archives.
Who is affected by CVE-2025-1550?
Any user or application that utilizes the Keras Model.load_model function is potentially affected by CVE-2025-1550.