CVE-2025-9905 - CVE House
Back to Database
Status published High CVE-2025-9905

Arbitary Code execution in Keras load_model()

Vulnerability Description

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9905

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Gabriele Digregorio

References

More from Keras-team

View All →
CVE-2025-9906
Arbitrary Code execution in Keras Safe Mode
High 8.6

Affected Vendor

Affected Software

Keras
Vulnerable Versions:
3.0.0

Timeline

Official Publish: September 19th, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-913

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.