https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:55:29 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07995 bdu:2026-07995 https://cve.radiocsirt.org/vuln/bdu:2026-07995 https://cve.radiocsirt.org/vuln/euvd-2026-272074 EUVD-2026-272074 https://cve.radiocsirt.org/vuln/euvd-2026-272074 https://cve.radiocsirt.org/vuln/fkie_cve-2025-9905 <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.</p> <p>One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.</p> <p>This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.</p> <p>Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.</p> <p>One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.</p> <p>This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.</p> <p>Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-9905 https://cve.radiocsirt.org/vuln/ghsa-36rr-ww3j-vrjv <p><strong>Affected:</strong> PyPI: keras</p> <p>**Note:** This report has already been discussed with the Google OSS VRP team, who recommended that I reach out directly to the Keras team. I’ve chosen to do so privately rather than opening a public issue, due to the potential security implications. I also attempted to use the email address listed in your `SECURITY.md`, but received no response.</p> <p>---</p> <p>## Summary</p> <p>When a model in the `.h5` (or `.hdf5`) format is loaded using the Keras `Model.load_model` method, the `safe_mode=True` setting is **silently** ignored without any warning or error. This allows an attacker to execute arbitrary code on the victim’s machine with the same privileges as the Keras application. This report is specific to the `.h5`/`.hdf5` file format. The attack works regardless of the other parameters passed to `load_model` and does not require any sophisticated technique—`.h5` and `.hdf5` files are simply not checked for unsafe code execution.</p> <p>From this point on, I will refer only to the `.h5` file format, though everything equally applies to `.hdf5`.</p> <p>## Details</p> <p>### Intended behaviour According to the official Keras documentation, `safe_mode` is defined as:</p> <p>``` safe_mode: Boolean, whether to disallow unsafe lambda deserialization. When safe_mode=False, loading an object has the potential to trigger arbitrary code execution. This argument is only applicable to the Keras v3 model format. Defaults to True. ``` I understand that the behavior described in this report is somehow **intentional**, as `saf…</p> <p><strong>Affected:</strong> PyPI: keras</p> <p>**Note:** This report has already been discussed with the Google OSS VRP team, who recommended that I reach out directly to the Keras team. I’ve chosen to do so privately rather than opening a public issue, due to the potential security implications. I also attempted to use the email address listed in your `SECURITY.md`, but received no response.</p> <p>---</p> <p>## Summary</p> <p>When a model in the `.h5` (or `.hdf5`) format is loaded using the Keras `Model.load_model` method, the `safe_mode=True` setting is **silently** ignored without any warning or error. This allows an attacker to execute arbitrary code on the victim’s machine with the same privileges as the Keras application. This report is specific to the `.h5`/`.hdf5` file format. The attack works regardless of the other parameters passed to `load_model` and does not require any sophisticated technique—`.h5` and `.hdf5` files are simply not checked for unsafe code execution.</p> <p>From this point on, I will refer only to the `.h5` file format, though everything equally applies to `.hdf5`.</p> <p>## Details</p> <p>### Intended behaviour According to the official Keras documentation, `safe_mode` is defined as:</p> <p>``` safe_mode: Boolean, whether to disallow unsafe lambda deserialization. When safe_mode=False, loading an object has the potential to trigger arbitrary code execution. This argument is only applicable to the Keras v3 model format. Defaults to True. ``` I understand that the behavior described in this report is somehow **intentional**, as `saf…</p> https://cve.radiocsirt.org/vuln/ghsa-36rr-ww3j-vrjv https://cve.radiocsirt.org/vuln/msrc_cve-2025-9905 msrc_CVE-2025-9905 https://cve.radiocsirt.org/vuln/msrc_cve-2025-9905 https://cve.radiocsirt.org/vuln/pysec-2025-123 <p><strong>Affected:</strong> PyPI: keras</p> <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.</p> <p>One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.</p> <p>This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.</p> <p>Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> <p><strong>Affected:</strong> PyPI: keras</p> <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.</p> <p>One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.</p> <p>This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.</p> <p>Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> https://cve.radiocsirt.org/vuln/pysec-2025-123 https://cve.radiocsirt.org/vuln/rhsa-2025:22759 <p>keras: Arbitary Code execution in Keras load_model() keras: Keras Path Traversal Vulnerability database/sql: Postgres Scan Race Condition aiohttp: AIOHTTP HTTP Request/Response Smuggling golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check github.com/argoproj/argo-workflows: Argo Workflows Zip Slip starlette: Starlette DoS via Range header merging</p> <p>keras: Arbitary Code execution in Keras load_model() keras: Keras Path Traversal Vulnerability database/sql: Postgres Scan Race Condition aiohttp: AIOHTTP HTTP Request/Response Smuggling golang: archive/tar: Unbounded allocation when parsing GNU sparse map axios: Axios DoS via lack of data size check github.com/argoproj/argo-workflows: Argo Workflows Zip Slip starlette: Starlette DoS via Range header merging</p> https://cve.radiocsirt.org/vuln/rhsa-2025:22759 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-9905 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: keras, Ubuntu:20.04:LTS: keras</p> <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: keras, Ubuntu:20.04:LTS: keras</p> <p>The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-9905