Executive brief
Keras, a popular machine learning library, is vulnerable to a security bypass that occurs when loading untrusted AI models. Even when 'safe_mode' is enabled, a maliciously crafted model can trick the system into downloading and overwriting files on the user's computer. This could allow an attacker to gain full remote access to a victim's machine or execute unauthorized code by replacing critical system files.
Technical details
A vulnerability in Keras v3 (CWE-502) allows an attacker to bypass the 'safe_mode' deserialization protection. While 'safe_mode' is intended to block arbitrary Python code in Lambda layers, the mitigation introduced for CVE-2025-1550 only checks if the module being called belongs to an internal Keras package. An attacker can craft a model that uses legitimate internal functions, such as 'keras.utils.get_file', with malicious arguments to download remote files to arbitrary local paths. This can be used to overwrite sensitive files (e.g., SSH authorized_keys) to achieve remote code execution. The issue is fixed in Keras version 3.11.0.
Affected products
- Keras Team Keras >= 3.0.0, < 3.11.0
Timeline
- 2025-08-11: disclosed
- 2025-08-12: advisory
- 2025-08-12: patched: Fixed in version 3.11.0