Critical severity · published Oct 17, 2025
CVE-2025-49655
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file…
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keras · Keras
3.11.0 before 3.11.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49655
github.com
https://github.com/keras-team/keras/pull/21575
hiddenlayer.com
https://hiddenlayer.com/sai_security_advisor/2025-10-keras/
More from Keras
9.8
CVE-2026-12481
Deserialization of Untrusted Data in keras-team/keras
9.8
CVE-2025-1550
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive
9.8
CVE-2024-3660
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a…
8.9
CVE-2025-12060
Keras keras.utils.get_file Utility Path Traversal Vulnerability
8.1
CVE-2026-11816
Path Traversal in keras-team/keras