Read the docs
TI-2025-09090 Aliases CVE-2025-9905GHSA-36rr-ww3j-vrjv

Arbitary Code execution in Keras load_model()

Priority LOW 33CWE-913Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial keras (PyPI): 3.11.3Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
keras-teamKeras3.0.0 – 3.11.2—No fix listedCNA
—keras (PyPI)3.0.0 to before 3.11.33.11.3Patch availableGHSA-36rr-ww3j-vrjv
  • Keras Vendorkeras-team Affected 3.0.0 – 3.11.2 Fixed in — No fix listed CNA
  • keras (PyPI) Vendor— Affected 3.0.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-36rr-ww3j-vrjv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:*3.0.0 to before 3.11.3Vulnerablekeras-team
  • cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.11.3 Vulnerable ·keras-team

Remediation

  • Fix · GHSA-36rr-ww3j-vrjv keras (PyPI) Fixed in 3.11.3 Advisory →

Red Hat 2 advisories

  • RHSA-2025:23531 Released 2025-12-17 · Red Hat rating Important
    RHOAI 2.25.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
  • RHSA-2025:22759 Released 2025-12-04 · Red Hat rating Important
    RHOAI 2.22.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.22 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel9 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Will not fix
Red Hat OpenShift AI 2.22Fixed RHSA-2025:22759
Red Hat OpenShift AI 2.25Fixed RHSA-2025:23531
Not affected: 2 products
  • Red Hat OpenShift AI 2.22
  • Red Hat OpenShift AI 2.25

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9905
  2. 2026-10-03 Alias added: GHSA-36rr-ww3j-vrjv

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
  • TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
  • TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
  • TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
  • TI-2025-01336 Arbitrary Code Execution via Crafted Keras Config for Model Loading CVSS 4.0HIGH 7.3
  • TI-2026-10716 Path Traversal via Symlink Name Validation Bypass in keras-team/keras CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences