CVE-2025-9906

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

• CWE-502

• https://github.com/keras-team/keras/pull/21429Issue Tracking

Published

Sep 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9900A flaw was found in Libtiff. This vulnerability is a "write-…8.8
• CVE-2025-9901A flaw was found in libsoup’s caching mechanism, SoupCache, …5.9
• CVE-2025-9902Authorization Bypass Through User-Controlled Key vulnerabili…7.5
• CVE-2025-9903Out-of-bounds write vulnerabilities in print processing of G…5.9
• CVE-2025-9904Unallocated memory access vulnerability in print processing …6.9
• CVE-2025-9905The Keras Model.load_model method can be exploited to achiev…7.3
• CVE-2025-9907A flaw was found in the Red Hat Ansible Automation Platform,…6.7
• CVE-2025-9908A flaw was found in the Red Hat Ansible Automation Platform,…6.7
• CVE-2025-9909A flaw was found in the Red Hat Ansible Automation Platform …6.7
• CVE-2025-9910Versions of the package jsondiffpatch before 0.7.2 are vulne…4.7
• CVE-2025-9912Nokia SR Linux is vulnerable to a local privilege escalation…6.3
• CVE-2025-9913JavaScript can be ran inside the address bar via the dashboa…6.1