Quick answers
- Is CVE-2025-9905 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-9905 being exploited in the wild.
- How severe is CVE-2025-9905?
- High severity, with a CVSS score of 4, published 19 September 2025.
- Which products and versions are affected?
- keras (PyPI) >= 3.0.0, < 3.11.3, ECOSYSTEM:introduced=3.0.0,fixed=3.11.3.
- Is there a fix for CVE-2025-9905?
- Yes. keras (PyPI): upgrade to 3.11.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-9905 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-9905?
- Check whether you run keras (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- keras (PyPI): upgrade to 3.11.3 or later
pip install "keras>=3.11.3"
Technical details
A vulnerability exists in Keras's `Model.load_model` API due to improper handling of the `safe_mode` parameter for legacy file formats. While `safe_mode=True` is intended to disallow unsafe lambda deserialization, the implementation in `keras/src/saving/saving_api.py` delegates .h5/.hdf5 loading to `legacy_h5_format.load_model_from_hdf5`, which does not implement or check the `safe_mode` flag. An attacker can craft a malicious HDF5 file containing a Lambda layer with an arbitrary Python payload. When a victim loads this file, the payload is executed during deserialization regardless of the `safe_mode` setting. This is fixed in version 3.11.3 by ensuring the security parameter is respected or an error is raised.
Affected products
- keras-team keras >= 3.0.0, < 3.11.3
Identifiers
- CVE-2025-9905
- GHSA-36rr-ww3j-vrjv
- PYSEC-2025-123
Timeline
- 2025-09-19: disclosed
- 2025-09-19: advisory
- 3.11.3: patched