TI-2025-09091 Aliases CVE-2025-9906 GHSA-36fq-jgmw-4r9c

Arbitrary Code execution in Keras Safe Mode

LOW 39CWE-502Published 2025-09-19 · Updated 2026-02-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00203 10th percentileScored 2026-11-07

Fix Partial Keras (Keras-team): 3.11.0keras (PyPI): 3.11.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
keras-team	Keras	3.0.0 to before 3.11.0	3.11.0	Patch available	CNA
—	keras (PyPI)	before 3.11.0	3.11.0	Patch available	GHSA-36fq-jgmw-4r9c

Keras Vendorkeras-team Affected 3.0.0 to before 3.11.0 Fixed in 3.11.0 Patch available CNA
keras (PyPI) Vendor— Affected before 3.11.0 Fixed in 3.11.0 Patch available GHSA-36fq-jgmw-4r9c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:keras:keras::::::::	3.0.0 to before 3.11.0	Vulnerable	keras-team

cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.11.0 Vulnerable ·keras-team

Remediation

Fix · CNA Keras (Keras-team) Fixed in 3.11.0
Fix · GHSA-36fq-jgmw-4r9c keras (PyPI) Fixed in 3.11.0 Advisory →

Red Hat 1 advisory

RHSA-2025:23531 Released 2025-12-17 · Red Hat rating Important
RHOAI 2.25.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix planned: Will not fix
Red Hat OpenShift AI 2.25	Fixed	RHSA-2025:23531

Not affected: 1 product

Red Hat OpenShift AI 2.25

Timeline

2026-10-02 Threatist record created from CVE-2025-9906
2026-10-03 Alias added: GHSA-36fq-jgmw-4r9c

References

Patch 1

https://github.com/keras-team/keras/pull/21429

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-9906

Other 5

TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
TI-2025-01336 Arbitrary Code Execution via Crafted Keras Config for Model Loading CVSS 4.0HIGH 7.3
TI-2026-10716 Path Traversal via Symlink Name Validation Bypass in keras-team/keras CVSS 3.1MEDIUM 6.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences