CVE-2025-1550
Arbitrary Code Execution via Crafted Keras Config for Model Loading
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Keras 2.15 - Remote Code Execution (RCE)2025-07-16 · remote · python
Impact
### Impact The Keras `Model.load_model` function permits arbitrary code execution, even with `safe_mode=True`, through a manually constructed, malicious `.keras` archive. By altering the `config.json` file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading. ### Patches This problem is fixed starting with version `3.9`. ### Workarounds Only load models from trusted sources and model archives created with Keras. ### References - https://www.cve.org/cverecord?id=CVE-2025-1550 - https://github.com/keras-team/keras/pull/20751
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | keras | >= 3.0.0, < 3.9.0 | 3.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Keras | Keras | from 3.0.0 before 3.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/keras-team/keras/pull/20751
- https://towerofhanoi.it/writeups/cve-2025-1550/
- https://github.com/advisories/GHSA-48g7-3x6r-xfhp
- https://github.com/keras-team/keras/security/advisories/GHSA-48g7-3x6r-xfhp
- https://nvd.nist.gov/vuln/detail/CVE-2025-1550
- https://github.com/keras-team/keras/commit/e67ac8ffd0c883bec68eb65bb52340c7f9d3a903
- https://github.com/keras-team/keras/releases/tag/v3.9.0
- https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-122.yaml
- https://towerofhanoi.it/writeups/cve-2025-1550