Executive brief
Keras, a popular deep learning library, contains a vulnerability that allows malicious code to run when a specially crafted model file is loaded. Even when using the library's 'safe mode,' an attacker can hide malicious commands inside the model's configuration file. If a user or automated system loads a compromised model, an attacker could gain full control over the system, potentially leading to data theft or service disruption.
Technical details
A code injection vulnerability exists in the Keras `Model.load_model` function. The root cause is improper validation of the `config.json` file within the `.keras` archive format, which allows an attacker to specify arbitrary Python modules and functions to be executed during the deserialization process. This bypasses the intended protections of `safe_mode=True`. An attacker must provide a maliciously crafted model file to a victim; when the victim loads this model locally, the attacker's code executes with the privileges of the running process. The issue is resolved in Keras version 3.9.0 by improving the safety of the model loading mechanism.
Affected products
- Keras Team Keras >= 3.0.0, < 3.9.0
Timeline
- 2025-03-11: disclosed
- 2025-03-11: advisory
- 2025-03-11: patched: Fixed in version 3.9.0