Executive brief
Keras, a popular machine learning library, contains a vulnerability where it fails to enforce security settings when loading older model file formats (.h5 and .hdf5). Even if a user explicitly enables 'safe mode' to prevent malicious code from running, the system ignores this setting for these specific files. An attacker could distribute a specially crafted model file that, when opened by a user, executes arbitrary commands on their computer with the user's full permissions.
Technical details
A vulnerability exists in Keras's `Model.load_model` API due to improper handling of the `safe_mode` parameter for legacy file formats. While `safe_mode=True` is intended to disallow unsafe lambda deserialization, the implementation in `keras/src/saving/saving_api.py` delegates .h5/.hdf5 loading to `legacy_h5_format.load_model_from_hdf5`, which does not implement or check the `safe_mode` flag. An attacker can craft a malicious HDF5 file containing a Lambda layer with an arbitrary Python payload. When a victim loads this file, the payload is executed during deserialization regardless of the `safe_mode` setting. This is fixed in version 3.11.3 by ensuring the security parameter is respected or an error is raised.
Affected products
- keras-team keras >= 3.0.0, < 3.11.3
Timeline
- 2025-09-19: disclosed
- 2025-09-19: advisory
- 3.11.3: patched