Arbitrary Code Execution via Crafted Keras Config for Model Loading
A vulnerability in Keras Model.load_model permitted arbitrary code execution through malicious .keras model files, even when the safe_mode parameter was set to True. The vulnerability was fixed in Keras 3.9.0 following discovery by a security researcher.
What happened
Keras Model.load_model function permits arbitrary code execution through a manually constructed, malicious .keras archive by altering the config.json file to specify arbitrary Python modules and functions to be loaded and executed during model loading.
The vulnerability affects the Keras model format .keras and works regardless of parameters passed to load_model, including when safe_mode is set to True by default, contradicting the documented behavior that safe_mode=True disallows unsafe deserialization.
Reported impact
A victim can be compromised simply by executing keras.saving.load_model('model.keras') with a malicious model, as the attack does not depend on Lambda layers or custom object definitions.
Index analysis
The vulnerability was due to incorrect validation of allowed modules and missing checks in parts of the loading code during deserialization of functional models.
Governance controls
Keras added checks to deserialization in pull request #20751, merged on January 12, 2025, with fixes for functional models.
The vulnerability was fixed in Keras 3.9.0.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.