{"id":"CVE-2025-1550","aliases":["GHSA-48g7-3x6r-xfhp","PYSEC-2025-122"],"title":"Arbitrary Code Execution via Crafted Keras Config for Model Loading","summary":"Arbitrary Code Execution via Crafted Keras Config for Model Loading","severity":"high","vendor":"keras","product":"keras","ecosystem":"pip","affected":["keras >= 3.0.0, < 3.9.0"],"patched":["keras 3.9.0"],"published":"2025-03-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:56.790604392Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-48g7-3x6r-xfhp","references":[{"url":"https://github.com/keras-team/keras/security/advisories/GHSA-48g7-3x6r-xfhp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1550"},{"url":"https://github.com/keras-team/keras/pull/20751"},{"url":"https://github.com/keras-team/keras/commit/e67ac8ffd0c883bec68eb65bb52340c7f9d3a903"},{"url":"https://github.com/keras-team/keras"},{"url":"https://github.com/keras-team/keras/releases/tag/v3.9.0"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-122.yaml"},{"url":"https://towerofhanoi.it/writeups/cve-2025-1550"}],"tags":["osv","pip","exploit-available"],"epss":0.02626,"epssPercentile":0.84824,"exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/ChCh0i/cve-2025-1550"],"checkedAt":"2026-09-23T07:13:33.896Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.651Z","slug":"CVE-2025-1550","body":"## Overview\n\n### Impact\n\nThe Keras `Model.load_model` function permits arbitrary code execution, even with `safe_mode=True`, through a manually constructed, malicious `.keras` archive. By altering the `config.json` file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.\n\n### Patches\n\nThis problem is fixed starting with version `3.9`.\n\n### Workarounds\n\nOnly load models from trusted sources and model archives created with Keras.\n\n### References\n\n- https://www.cve.org/cverecord?id=CVE-2025-1550\n- https://github.com/keras-team/keras/pull/20751\n\n## Affected packages\n\n- `keras >= 3.0.0, < 3.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `keras 3.9.0`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[]}