Keras framework vulnerable to deserialization of untrusted data
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-49655US | — | — | ||
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file co… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/keras-team/kerasPACKAGE
- https://github.com/keras-team/keras/pull/21575WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2026-368.yamlWEB
- https://hiddenlayer.com/sai_security_advisor/2025-10-kerasWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-49655ADVISORY
- https://pypi.org/project/kerasWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan