Paper/Archive/CVE-2025-49655

CVE-2025-49655

Keras Keras — Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, en…

EPSS 0.8%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.0.550 × 2011.0 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

Affected

ProductAffectedFixed inSource

Keras3.11.0 – < 3.11.33.11.3CNA

Scores by source

HiddenLayer (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhiddenlayer.com/sai_security_advisor/2025-10-keras refgithub.com/keras-team/keras/pull/21575