Deserialization of untrusted data in keras-team Keras
Priority HIGH 82CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0075 55th percentileScored 2026-11-07
Fix Fixed Keras (Keras): 3.11.3keras (PyPI): 3.11.3Red Hat: 2 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| keras-team | Keras | 3.11.0 to before 3.11.3 | 3.11.3 | Patch available | CNA |
| — | keras (PyPI) | 3.11.0 to before 3.11.3 | 3.11.3 | Patch available | GHSA-cvhh-q5g5-qprp |
- Keras Vendorkeras-team Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available CNA
- keras (PyPI) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-cvhh-q5g5-qprp
Remediation
- Fix · CNA Keras (Keras) Fixed in 3.11.3
- Fix · GHSA-cvhh-q5g5-qprp keras (PyPI) Fixed in 3.11.3 Advisory →
Red Hat 2 advisories
- RHSA-2025:23531 Released 2025-12-17 · Red Hat rating ImportantRHOAI 2.25.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9 +34
- RHSA-2025:22068 Released 2025-11-25 · Red Hat rating ImportantRHTAS 1.3.1 - Tech Preview Release of Model Transparency
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/model-transparency-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2025:23531 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2025:22068 |
Not affected: 2 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49655
- 2026-10-03 Alias added: GHSA-cvhh-q5g5-qprp
References
Other 6
- https://hiddenlayer.com/sai_security_advisor/2025-10-keras/
- https://github.com/keras-team/keras/pull/21575
- https://github.com/keras-team/keras
- https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2026-368.yaml
- https://hiddenlayer.com/sai_security_advisor/2025-10-keras
- https://pypi.org/project/keras
More keras-team vulnerabilities
- TI-2026-10715 Deserialization of Untrusted Data in keras-team/keras CVSS 3.1CRITICAL 9.8
- TI-2026-01159 Safe Mode Bypass in keras-team/keras CVSS 3.0HIGH 8.8
- TI-2025-08001 Keras safe_mode bypass allows arbitrary code execution when loading a malicious model. CVSS 4.0HIGH 8.6
- TI-2026-10199 Path Traversal in keras-team/keras CVSS 3.0HIGH 8.1
- TI-2025-11591 Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file() CVSS 3.0HIGH 8.0
- TI-2026-10718 Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config CVSS 3.0HIGH 7.8
Sources
- CVE-2025-49655 · CVE Program
- CVE-2025-49655 · NVD
- FIRST EPSS
- GHSA-cvhh-q5g5-qprp · GitHub Advisory Database · CC BY 4.0
- CVE-2025-49655 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences