CVE-2025-49655 Overview
CVE-2025-49655 is a critical deserialization vulnerability in the Keras deep learning framework. The flaw affects Keras versions 3.11.0 up to but not including 3.11.3. Attackers can craft a malicious Keras model file containing a TorchModuleWrapper class that executes arbitrary code when loaded. The vulnerability bypasses Keras safe mode, which is the documented defense against untrusted model loading. Both local and remote model files can trigger exploitation, making this a network-reachable issue [CWE-502].
Critical Impact
Loading an untrusted .keras file results in arbitrary code execution on the host with the privileges of the Python process, even when safe mode is enabled.
Affected Products
- Keras framework version 3.11.0
- Keras framework versions up to but not including 3.11.3
- Python applications, notebooks, and ML pipelines that load third-party Keras models
Discovery Timeline
- 2025-10-17 - CVE-2025-49655 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-49655
Vulnerability Analysis
Keras supports serializing model components through its native .keras archive format. The framework provides a safe mode flag intended to block deserialization of arbitrary Python objects when loading untrusted models. The TorchModuleWrapper class, used to embed PyTorch modules inside Keras models, was not properly constrained by the safe mode check. When the loader reconstructs a TorchModuleWrapper instance, it invokes torch.load, which internally uses Python's pickle module on attacker-controlled bytes. Pickle deserialization invokes arbitrary callables encoded in the stream, producing code execution at load time. The maintainers addressed the issue in the Keras Pull Request 21575 and the HiddenLayer Security Advisory documents the disclosure.
Root Cause
The root cause is an insecure deserialization path [CWE-502] reachable through the TorchModuleWrapper class. Safe mode logic failed to enumerate this wrapper as a dangerous reconstruction target. PyTorch's torch.load defaults to pickle-based loading, which executes embedded reduce callables without validation.
Attack Vector
An attacker hosts or distributes a crafted .keras file containing a TorchModuleWrapper payload. When a victim calls keras.models.load_model() on the file, the embedded pickle stream executes attacker-controlled code. Distribution channels include model hubs, shared notebooks, supply chain dependencies, and remote URLs loaded directly by Keras. No authentication or user interaction beyond loading the model is required.
No verified public proof-of-concept code is included in this advisory. Refer to the linked technical references for reproduction details.
Detection Methods for CVE-2025-49655
Indicators of Compromise
- Presence of TorchModuleWrapper references inside .keras archive files originating from untrusted sources
- Python processes spawning shell interpreters, curl, wget, or compilers shortly after invoking keras.models.load_model()
- Unexpected outbound network connections from data science workstations or ML training nodes during model load operations
Detection Strategies
- Inventory installed Keras versions across developer workstations and training clusters and flag any instance between 3.11.0 and 3.11.2 inclusive
- Inspect .keras files as ZIP archives and scan config.json for TorchModuleWrapper class references and embedded pickle artifacts
- Hook or audit calls to pickle.load, torch.load, and keras.models.load_model in CI pipelines that process third-party models
Monitoring Recommendations
- Log child process creation from Python interpreters running ML workloads and alert on shell or LOLBin descendants
- Monitor egress traffic from Jupyter, MLflow, and training hosts for connections to unrecognized domains
- Track file integrity on directories that store downloaded model artifacts and review provenance of new .keras files
How to Mitigate CVE-2025-49655
Immediate Actions Required
- Upgrade Keras to version 3.11.3 or later on all systems that load model files
- Treat every .keras file from external sources as untrusted until validated in an isolated environment
- Audit existing model repositories for files referencing TorchModuleWrapper and quarantine suspicious artifacts
Patch Information
The fix is merged in Keras Pull Request 21575 and released in Keras 3.11.3. Update via pip install --upgrade keras>=3.11.3. Review the HiddenLayer Security Advisory for vendor guidance and reproduction context.
Workarounds
- Pin Keras to a version prior to 3.11.0 until upgrading to 3.11.3 is feasible
- Load untrusted models only inside sandboxed containers without network egress or sensitive credentials
- Restrict model loading code paths to signed artifacts produced by internal training pipelines
# Configuration example
pip install --upgrade "keras>=3.11.3"
python -c "import keras; print(keras.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
