CVE-2025-9906: Arbitrary Code execution in Keras Safe Mode
Arbitrary Code Execution in Keras
Keras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted .keras model archive, even when safemode=True.
The issue arises because the archive’s config.json is parsed before layer deserialization. This can invoke keras.config.enableunsafedeserialization(), effectively disabling safe mode from within the loading process itself. An attacker can place this call first in the archive and then include a Lambda layer whose function is deserialized from a pickle, leading to the execution of attacker-controlled Python code as soon as a victim loads the model file.
Exploitation requires a user to open an untrusted model; no additional privileges are needed. The fix in version 3.11.0 enforces safe-mode semantics before reading any user-controlled configuration and prevents the toggling of unsafe deserialization via the config file.
Affected versions: < 3.11.0 Patched version: 3.11.0
It is recommended to upgrade to version 3.11.0 or later and to avoid opening untrusted model files.
Other sources
Arbitrary Code execution in Keras Safe Mode
— Microsoft
The Keras Model.loadmodel method can be exploited to achieve arbitrary code execution, even with safemode=True.
One can create a specially crafted .keras model archive that, when loaded via Model.loadmodel, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enableunsafedeserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enableunsafedeserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9906?
CVE-2025-9906 is classified as a high-severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2025-9906?
To mitigate CVE-2025-9906, ensure you are using a patched version of Keras where this vulnerability has been addressed.
What types of attacks can CVE-2025-9906 facilitate?
CVE-2025-9906 can facilitate attacks that result in arbitrary code execution when loading malicious .keras model files.
Is safe_mode=True effective against CVE-2025-9906?
Setting safe_mode=True does not prevent the exploitation of CVE-2025-9906, making it necessary to update to a secure version.
Which versions of Keras are affected by CVE-2025-9906?
All versions of Keras prior to the fix for CVE-2025-9906 are potentially affected and vulnerable to this issue.