CVE-2025-1550

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.

CVSS

No CVSS.

References

Link	Resource
https://github.com/keras-team/keras/pull/20751
https://towerofhanoi.it/writeups/cve-2025-1550/

Configurations

No configuration.

History

22 Jul 2025, 16:15

Type	Values Removed	Values Added
References		() https://towerofhanoi.it/writeups/cve-2025-1550/ -
Summary		(es) La función Keras Model.load_model permite la ejecución de código arbitrario, incluso con safe_mode=True, a través de un archivo .keras malicioso creado manualmente. Al alterar el archivo config.json dentro del archivo, un atacante puede especificar módulos y funciones Python arbitrarios, junto con sus argumentos, para que se carguen y ejecuten durante la carga del modelo.

11 Mar 2025, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-11 09:15

Updated : 2025-07-22 16:15

NVD link : CVE-2025-1550

Mitre link : CVE-2025-1550

CVE.ORG link : CVE-2025-1550

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-1550", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-11T09:15:25.217", "references": [{"url": "https://github.com/keras-team/keras/pull/20751", "source": "cve-coordination@google.com"}, {"url": "https://towerofhanoi.it/writeups/cve-2025-1550/", "source": "cve-coordination@google.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading."}, {"lang": "es", "value": "La funci\u00f3n Keras Model.load_model permite la ejecuci\u00f3n de c\u00f3digo arbitrario, incluso con safe_mode=True, a trav\u00e9s de un archivo .keras malicioso creado manualmente. Al alterar el archivo config.json dentro del archivo, un atacante puede especificar m\u00f3dulos y funciones Python arbitrarios, junto con sus argumentos, para que se carguen y ejecuten durante la carga del modelo."}], "lastModified": "2025-07-22T16:15:26.617", "sourceIdentifier": "cve-coordination@google.com"}