CVE-2025-9905: keras-team keras
Vulnerability summary
CVE-2025-9905 is a high (CVSS 7.3) vulnerability in keras-team keras. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 19-09-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.
CVSS metrics
8 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- NVDNIST7.3HighCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.3HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
+0.01 pp
From 0.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundKeras
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- tensorflow-cpu-jupyter< 2.20.0-r1
- tensorflow-gpu-jupyter< 2.20.0-r1
Debian1 product
- kerasAll versions (No fix recorded)
Keras1 product
- keras≥ 3.0.0, < 3.11.3
Keras-team1 product
- keras≥ 3.0.0, ≤ 3.11.2
PyPI1 product
- keras≥ 3.0.0, < 3.11.3
Ubuntu1 product
- kerasAll versions (No fix recorded)
6 vendors · 7 products
References
9 links- github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjvWEBEVIDENCEREPORTAdvisoryExploitVendor Advisory
- github.com/keras-team/kerasPACKAGE
