Product: Keras Summary The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. A specially crafted .h5/.hdf5 model archive can trigger arbitrary code execution when loaded. This vulnerability arises because the safe_mode=True option is not honored when reading .h5 archives. Details SeverityBase ScoreCVEHIGH7.3CVE-2025-9905 Exploitation To exploit this vulnerability, an attacker can create a malicious .h5 or .hdf5 model file that utilizes the Lambda layer feature of Keras, allowing arbitrary Python code to be executed. When this crafted model is loaded using the Model.load_model method, it bypasses the safe_mode setting and executes the embedded code, leading to arbitrary code execution on the host system. Affected Products Keras: The Keras library for deep learning, which supports the .h5/.hdf5 format for model storage. Mitigation To mitigate this vulnerability, users should avoid loading untrusted .h5 or .hdf5 model files. It is recommended to validate and sanitize model files before loading them, and to keep Keras updated to the latest version where potential vulnerabilities are addressed. References Keras Pull RequestKeras Security Advisory
