CVE-2025-9905 Details
Description
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.
A vulnerability in the Keras library's model loading function for the legacy HDF5 format (.h5/.hdf5) allows for arbitrary code execution. This issue arises because the 'safe_mode=True' option is not properly enforced when loading .h5 archives, creating the potential for exploitation. The vulnerability leverages the Lambda layer feature, which can execute arbitrary Python code through pickling. Although Keras 3 maintains this format for compatibility, the lack of effective safety measures presents a significant risk.
Users can update to Keras version 3.11.3, which restores the 'safe_mode' functionality in the legacy H5 loading process, preventing the execution of unsafe custom objects by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/keras-team/keras/pull/21602 | [email protected] | Issue TrackingPatch |
| https://github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| keras keras | >= 3.0.0, < 3.11.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2025 | Initial Analysis | [email protected] |
| Sep 19, 2025 | New CVE Received | [email protected] |