CVE-2025-49655 Details

A vulnerability allowing arbitrary code execution exists in the Keras framework, specifically in versions 3.11.0 prior to 3.11.3. The issue arises in the TorchModuleWrapper class, where the from_config method deserializes model data using torch.load() with the weights_only parameter set to False. This configuration causes Torch to rely on Python's pickle module for deserialization, which is inherently unsafe and can execute arbitrary code. A maliciously crafted Keras model file could exploit this behavior, executing unauthorized commands on the user's system when the model is loaded, even with safe mode enabled. The vulnerability can be triggered with both local and remote files.

Users can upgrade to Keras version 3.11.3, which disables the unsafe deserialization in the TorchModuleWrapper class when safe mode is enabled.