{"id":"CVE-2025-49655","aliases":["DEBIAN-CVE-2025-49655","EUVD-2025-34892","GHSA-cvhh-q5g5-qprp","PYSEC-2026-368","UBUNTU-CVE-2025-49655"],"status":"published","title":"Keras framework vulnerable to deserialization of untrusted data","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0075,"percentile":0.55276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2025-10-17T15:20:27Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"PyPI","package":"keras","fixed_in":["3.11.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1+dfsg-3","2.3.1+dfsg2-1"]},{"source":"osv","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.3"}]}],"versions":["3.11.0","3.11.1","3.11.2"]},{"source":"osv","ecosystem":"PyPI","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.3"}]}],"versions":["3.11.0","3.11.1","3.11.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7-2","2.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"keras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-1"]}],"products":[{"vendor":"google","product":"keras"},{"vendor":"keras","product":"keras"}],"references":[{"url":"https://hiddenlayer.com/sai_security_advisor/2025-10-keras/","tags":["web","report"]},{"url":"https://github.com/keras-team/keras/pull/21575","tags":["fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49655","tags":["advisory"]},{"url":"https://hiddenlayer.com/sai_security_advisor/2025-10-keras","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2026-368.yaml","tags":["web"]},{"url":"https://pypi.org/project/keras","tags":["web","package"]},{"url":"https://github.com/advisories/GHSA-cvhh-q5g5-qprp","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49655.json","tags":["advisory"]},{"url":"https://github.com/keras-team/keras","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-49655","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-49655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49655","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-49655","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T15:20:27.308Z","modified":"2025-10-17T15:58:34.204Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-34892","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T15:20:27Z","modified":"2025-10-17T15:58:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:30.508055Z"}],"ghsa":[{"id":"GHSA-cvhh-q5g5-qprp","title":"Keras framework vulnerable to deserialization of untrusted data","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T18:31:07Z","modified":"2026-10-27T17:19:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:38.969831Z"}],"nvd":[{"id":"CVE-2025-49655","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T16:15:37.42Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-49655","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T15:20:27.308Z","modified":"2026-10-28T02:30:25.060642263Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-49655","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T16:15:37.42Z","modified":"2026-08-27T23:05:40.290756484Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-cvhh-q5g5-qprp","title":"Keras framework vulnerable to deserialization of untrusted data","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T18:31:07Z","modified":"2026-10-27T17:30:37.908610942Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"PYSEC-2026-368","title":"Keras framework vulnerable to deserialization of untrusted data","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2026-06-29T11:50:37.095983Z","modified":"2026-07-01T20:22:55.074992Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2025-49655","description":"Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.","status":"published","published":"2025-10-17T16:15:00Z","modified":"2025-10-30T05:25:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:50.31802Z"}]}}