Advisoriesby IbisKerasGHSA-cvhh-q5g5-qprp
Keras framework vulnerable to deserialization of untrusted data
Fix: upgrade to 3.11.3 or later
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| keras PyPI | >= 3.11.0, < 3.11.3 | 3.11.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2025-49655, PYSEC-2026-368
More Keras advisories
All Keras
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight LoadingCVE-2026-1669fixed in 3.12.1 +1Keras Directory Traversal VulnerabilityCVE-2025-12060fixed in 3.12.0Keras is vulnerable to arbitrary local file loading and Server-Side Request ForgeryCVE-2025-12058fixed in 3.12.0Keras: code executionCVE-2025-9905fixed in 3.11.3Keras is vulnerable to Deserialization of Untrusted DataCVE-2025-9906fixed in 3.11.0Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionalityCVE-2025-8747fixed in 3.11.0