Keras up to 3.10.x enable_unsafe_deserialization

Summaryinfo

A vulnerability identified as problematic has been detected in Keras up to 3.10.x. Affected is the function enable_unsafe_deserialization. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2025-9906. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Keras up to 3.10.x. It has been classified as problematic. This affects the function enable_unsafe_deserialization. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

The weakness was published by Gabriele Digregorio. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-9906 since 09/03/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 265848 (Linux Distros Unpatched Vulnerability : CVE-2025-9906), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.11.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (265848) and EUVD (EUVD-2025-30281). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Keras

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion