CVE-2025-1550High▾ MidnightPoC availableArbitrary Code Execution via Crafted Keras Config for Model Loading
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.6%
Exploit-DB · 1 GitHub repo (last check)
The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.
This problem is fixed starting with version 3.9.
Only load models from trusted sources and model archives created with Keras.
keras >= 3.0.0, < 3.9.0Upgrade to a patched release:
keras 3.9.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-55459Mediumkeras Path Traversal vulnerability
CVE-2025-8747High· 8.8Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
CVE-2025-9905HighThe Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file i…
CVE-2026-12570Medium· 5.5A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading malicious .keras model files via the keras.models.load_model() function
CVE-2026-12484High· 7.8Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data
CVE-2026-12479Medium· 6.1Keras: DiskIOStore permits path traversal through crafted layer names