Is CVE-2025-8747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8747 being exploited in the wild.

How severe is CVE-2025-8747?

High severity, with a CVSS score of 8.8, published 12 August 2025.

Which products and versions are affected?

keras (PyPI) >= 3.0.0, < 3.11.0, ECOSYSTEM:introduced=3.0.0,fixed=3.11.0.

Is there a fix for CVE-2025-8747?

Yes. keras (PyPI): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-8747?

Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8747: Keras safe_mode bypass via internal function reuse

Q: Is there a fix for CVE-2025-8747?

Yes. keras (PyPI): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-8747 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-8747?

Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8747 · Severity: high · CVSS 8.8 · Published 2025-08-12

Keras, a popular machine learning library, is vulnerable to a security bypass that occurs when loading untrusted AI models. Even when 'safe_mode' is enabled, a maliciously crafted model can trick the system into downloading and overwriting files on the user's computer. This could allow an attacker to gain full remote access to a victim's machine or execute unauthorized code by replacing critical system files.

Technologies: keras (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-8747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8747 being exploited in the wild.
How severe is CVE-2025-8747?: High severity, with a CVSS score of 8.8, published 12 August 2025.
Which products and versions are affected?: keras (PyPI) >= 3.0.0, < 3.11.0, ECOSYSTEM:introduced=3.0.0,fixed=3.11.0.
Is there a fix for CVE-2025-8747?: Yes. keras (PyPI): upgrade to 3.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-8747?: Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

keras (PyPI): upgrade to 3.11.0 or later
```
pip install "keras>=3.11.0"
```

Technical details

A vulnerability in Keras v3 (CWE-502) allows an attacker to bypass the 'safe_mode' deserialization protection. While 'safe_mode' is intended to block arbitrary Python code in Lambda layers, the mitigation introduced for CVE-2025-1550 only checks if the module being called belongs to an internal Keras package. An attacker can craft a model that uses legitimate internal functions, such as 'keras.utils.get_file', with malicious arguments to download remote files to arbitrary local paths. This can be used to overwrite sensitive files (e.g., SSH authorized_keys) to achieve remote code execution. The issue is fixed in Keras version 3.11.0.

Affected products

Keras Team Keras >= 3.0.0, < 3.11.0

Identifiers

CVE-2025-8747
GHSA-c9rc-mg46-23w3
PYSEC-2025-75

Timeline

2025-08-11: disclosed
2025-08-12: advisory
2025-08-12: patched: Fixed in version 3.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.