Critical severity · published Mar 11, 2025
CVE-2025-1550
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keras · Keras
3.0.0 before 3.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1550
Issue Tracking
https://github.com/keras-team/keras/pull/20751
Exploit
https://towerofhanoi.it/writeups/cve-2025-1550/
More from Keras
9.8
CVE-2026-12481
Deserialization of Untrusted Data in keras-team/keras
9.8
CVE-2025-49655
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file…
9.8
CVE-2024-3660
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a…
8.9
CVE-2025-12060
Keras keras.utils.get_file Utility Path Traversal Vulnerability
8.1
CVE-2026-11816
Path Traversal in keras-team/keras