Arbitrary Code Execution in Keras by TensorFlow

CVE-2025-9906

What is CVE-2025-9906?

The Keras framework, utilized for building and training deep learning models, has a significant vulnerability that allows attackers to execute arbitrary code through the Model.load_model method. This exploit emerges when a maliciously crafted .keras model archive is loaded, bypassing the safe mode protection. The attack leverages a specially configured config.json file within the archive to trigger keras.config.enable_unsafe_deserialization(), thereby disabling the safety measures. By taking advantage of the Lambda layer feature of Keras, attackers can embed arbitrary Python code using pickled objects within the same archive. This vulnerability poses a serious risk, enabling unauthorized actions and potentially compromising the integrity of applications utilizing affected versions of Keras.

References