Critical severity · published Mar 11, 2025
CVE-2025-1550
Arbitrary Code Execution via Crafted Keras Config for Model Loading
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keras · Google
3.0.0 before 3.8.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1550
Issue Tracking
https://github.com/keras-team/keras/pull/20751
Exploit
https://towerofhanoi.it/writeups/cve-2025-1550/
More from Keras
7.8
CVE-2025-8747
Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.
7.5
CVE-2026-1669
Arbitrary File Read in Keras via HDF5 External Datasets
7.5
CVE-2026-0897
Denial of Service in Keras via Excessive Memory Allocation in HDF5 Metadata