{"id":"CVE-2025-9906","aliases":["GHSA-36fq-jgmw-4r9c","PYSEC-2025-76"],"title":"Keras is vulnerable to Deserialization of Untrusted Data","summary":"Keras is vulnerable to Deserialization of Untrusted Data","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","vendor":"keras","product":"keras","ecosystem":"pip","affected":["keras < 3.11.0"],"patched":["keras 3.11.0"],"published":"2025-09-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:27.820239587Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-36fq-jgmw-4r9c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9906"},{"url":"https://github.com/keras-team/keras/pull/21429"},{"url":"https://github.com/keras-team/keras/commit/713172ab56b864e59e2aa79b1a51b0e728bba858"},{"url":"https://github.com/keras-team/keras"},{"url":"https://github.com/keras-team/keras/releases/tag/v3.11.0"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-76.yaml"},{"url":"https://osv.dev/vulnerability/CVE-2025-9906"}],"tags":["osv","pip"],"epss":0.00199,"epssPercentile":0.10029,"ingestedAt":"2026-07-17T13:07:01.139Z","slug":"CVE-2025-9906","body":"## Overview\n\n### Arbitrary Code Execution in Keras\n\nKeras versions prior to 3.11.0 allow for arbitrary code execution when loading a crafted `.keras` model archive, even when `safe_mode=True`.\n\nThe issue arises because the archive’s `config.json` is parsed before layer deserialization. This can invoke `keras.config.enable_unsafe_deserialization()`, effectively disabling safe mode from within the loading process itself. An attacker can place this call first in the archive and then include a `Lambda` layer whose function is deserialized from a pickle, leading to the execution of attacker-controlled Python code as soon as a victim loads the model file.\n\nExploitation requires a user to open an untrusted model; no additional privileges are needed. The fix in version 3.11.0 enforces safe-mode semantics *before* reading any user-controlled configuration and prevents the toggling of unsafe deserialization via the config file.\n\n**Affected versions:** < 3.11.0\n**Patched version:** 3.11.0\n\nIt is recommended to upgrade to version 3.11.0 or later and to avoid opening untrusted model files.\n\n## Affected packages\n\n- `keras < 3.11.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `keras 3.11.0`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}