Product: Keras Summary The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. A specially crafted .keras model archive can trigger arbitrary code execution when loaded. This is done by including a config.json file that disables safe mode and allows the use of the Lambda layer feature for executing arbitrary Python code. Details SeverityBase ScoreCVEHIGH8.6CVE-2025-9906 Exploitation To exploit this vulnerability, an attacker must create a .keras model archive containing a config.json file that invokes keras.config.enable_unsafe_deserialization() to disable safe mode. Following this, the attacker can include a Lambda layer with arbitrary pickled Python code. The order of these components is crucial; the unsafe deserialization must be first in the archive, followed by the Lambda layer with the malicious code. Affected Products Keras: The primary product affected, allowing for arbitrary code execution through the Model.load_model method. Mitigation To mitigate this vulnerability, users should avoid loading untrusted .keras model archives. It is recommended to validate and review model files before loading them, ensuring that they do not contain any unsafe configurations or code. References Keras GitHub Pull Request
