CVE-2025-9906

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9906", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2025-09-03T07:27:23.895Z", "datePublished": "2025-09-19T08:15:04.349Z", "dateUpdated": "2026-02-26T17:48:23.819Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Keras", "repo": "https://github.com/keras-team/keras", "vendor": "Keras-team", "versions": [{"lessThan": "3.11.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Gabriele Digregorio"}], "datePublic": "2025-06-29T09:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The Keras <code>Model.load_model</code>&nbsp;method can be exploited to achieve arbitrary code execution, even with <code>safe_mode=True</code>.</p><p>One can create a specially crafted <code>.keras</code>&nbsp;model archive that, when loaded via <code>Model.load_model</code>, will trigger arbitrary code to be executed. This is achieved by crafting a special <code>config.json</code>&nbsp;(a file within the <code>.keras</code>&nbsp;archive) that will invoke <code>keras.config.enable_unsafe_deserialization()</code>&nbsp;to disable safe mode. Once safe mode is disable, one can use the <code>Lambda</code>&nbsp;layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the <code>keras.config.enable_unsafe_deserialization()</code>&nbsp;needs to appear first in the archive and the <code>Lambda</code>&nbsp;with arbitrary code needs to be second.</p><br>"}], "value": "The Keras Model.load_model\u00a0method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .keras\u00a0model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json\u00a0(a file within the .keras\u00a0archive) that will invoke keras.config.enable_unsafe_deserialization()\u00a0to disable safe mode. Once safe mode is disable, one can use the Lambda\u00a0layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization()\u00a0needs to appear first in the archive and the Lambda\u00a0with arbitrary code needs to be second."}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.6, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:A", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-09-19T08:15:04.349Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/keras-team/keras/pull/21429"}], "source": {"discovery": "EXTERNAL"}, "title": "Arbitrary Code execution in Keras Safe Mode", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9906", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-20T03:55:42.287333Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:23.819Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9906", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-20T03:55:42.287333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T11:51:40.833Z"}}], "cna": {"title": "Arbitrary Code execution in Keras Safe Mode", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Gabriele Digregorio"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 8.6, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:A", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/keras-team/keras", "vendor": "Keras-team", "product": "Keras", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-06-29T09:00:00.000Z", "references": [{"url": "https://github.com/keras-team/keras/pull/21429", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Keras Model.load_model\u00a0method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .keras\u00a0model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json\u00a0(a file within the .keras\u00a0archive) that will invoke keras.config.enable_unsafe_deserialization()\u00a0to disable safe mode. Once safe mode is disable, one can use the Lambda\u00a0layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization()\u00a0needs to appear first in the archive and the Lambda\u00a0with arbitrary code needs to be second.", "supportingMedia": [{"type": "text/html", "value": "<p>The Keras <code>Model.load_model</code>&nbsp;method can be exploited to achieve arbitrary code execution, even with <code>safe_mode=True</code>.</p><p>One can create a specially crafted <code>.keras</code>&nbsp;model archive that, when loaded via <code>Model.load_model</code>, will trigger arbitrary code to be executed. This is achieved by crafting a special <code>config.json</code>&nbsp;(a file within the <code>.keras</code>&nbsp;archive) that will invoke <code>keras.config.enable_unsafe_deserialization()</code>&nbsp;to disable safe mode. Once safe mode is disable, one can use the <code>Lambda</code>&nbsp;layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the <code>keras.config.enable_unsafe_deserialization()</code>&nbsp;needs to appear first in the archive and the <code>Lambda</code>&nbsp;with arbitrary code needs to be second.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2025-09-19T08:15:04.349Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9906", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:48:23.819Z", "dateReserved": "2025-09-03T07:27:23.895Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2025-09-19T08:15:04.349Z", "assignerShortName": "Google"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Keras", "repo": "https://github.com/keras-team/keras", "vendor": "Keras-team", "versions": [{"lessThan": "3.11.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "cve-coordination@google.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:keras:keras:*:*:*:*:*:*:*:*", "matchCriteriaId": "573E88B6-532F-4616-AC15-659DD4DF72F8", "versionEndExcluding": "3.11.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Keras Model.load_model\u00a0method can be exploited to achieve arbitrary code execution, even with safe_mode=True.\n\nOne can create a specially crafted .keras\u00a0model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json\u00a0(a file within the .keras\u00a0archive) that will invoke keras.config.enable_unsafe_deserialization()\u00a0to disable safe mode. Once safe mode is disable, one can use the Lambda\u00a0layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization()\u00a0needs to appear first in the archive and the Lambda\u00a0with arbitrary code needs to be second."}, {"lang": "es", "value": "El m\u00e9todo Model.load_model de Keras puede ser explotado para lograr ejecuci\u00f3n de c\u00f3digo arbitrario, incluso con safe_mode=True.\n\nSe puede crear un archivo de modelo .keras especialmente dise\u00f1ado que, al ser cargado a trav\u00e9s de Model.load_model, activar\u00e1 la ejecuci\u00f3n de c\u00f3digo arbitrario. Esto se logra dise\u00f1ando un archivo config.json especial (un archivo dentro del archivo .keras) que invocar\u00e1 keras.config.enable_unsafe_deserialization() para deshabilitar el modo seguro. Una vez que el modo seguro est\u00e1 deshabilitado, se puede usar la caracter\u00edstica de capa Lambda de Keras, que permite c\u00f3digo Python arbitrario en forma de c\u00f3digo serializado. Ambos pueden aparecer en el mismo archivo. Simplemente, keras.config.enable_unsafe_deserialization() debe aparecer primero en el archivo y la capa Lambda con c\u00f3digo arbitrario debe ser la segunda."}], "id": "CVE-2025-9906", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve-coordination@google.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9906", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-20T03:55:42.287333Z", "version": "2.0.3"}}]}, "published": "2025-09-19T09:15:36.353", "references": [{"source": "cve-coordination@google.com", "tags": ["Issue Tracking"], "url": "https://github.com/keras-team/keras/pull/21429"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{"bugzilla": {"description": "keras: Arbitrary Code execution in Keras Safe Mode", "id": "2396644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396644"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-9906", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-modelmesh-runtime-adapter-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-modelmesh-runtime-adapter-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2025-09-19T08:15:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-9906\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-9906\nhttps://github.com/keras-team/keras/pull/21429"], "threat_severity": "Important"}

{"created": "2025-09-22T10:00:15.179576+00:00", "updated": "2025-09-22T10:06:32.176019+00:00", "vendors": ["keras", "keras$PRODUCT$keras"]}