Arbitrary Code Execution in Keras ML Framework

CVE-2025-1550

What is CVE-2025-1550?

The Keras library's Model.load_model function is susceptible to an arbitrary code execution vulnerability. This issue arises when a malicious actor crafts a specific .keras archive that alters the config.json file within it. By doing so, they can instruct the model to load and execute arbitrary Python modules and functions, along with specified arguments, even when the safe_mode is enabled. This can potentially compromise the integrity of applications utilizing Keras, making it crucial for users to ensure they are using patched versions of the framework to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References