Product:
Keras
Summary
The Keras.Model.load_model method is vulnerable to arbitrary local file loading and Server-Side Request Forgery (SSRF). This vulnerability arises from the handling of the StringLookup layer during model loading from a specially crafted .keras archive. An attacker can exploit this by creating a malicious .keras file that embeds a local path, allowing them to read arbitrary local files on the hosting system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.9 | CVE-2025-12058 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious .keras file that includes a local file path in the StringLookup layer’s configuration. When the model is loaded, Keras will attempt to read the specified local file, enabling the attacker to access sensitive data. Additionally, the same mechanism can be used to perform SSRF attacks by fetching content from arbitrary network endpoints on the server’s behalf.
Affected Products
- Keras: Vulnerable to arbitrary local file read and SSRF due to improper handling of external path loading.
Mitigation
To mitigate this vulnerability, it is recommended to avoid using the StringLookup layer with untrusted .keras files. Additionally, ensure that the safe_mode=True flag is properly enforced to restrict external path loading. Regularly update Keras to the latest version to benefit from security patches.