CVE-2025-1550

🗓️ 11 Mar 2025 08:12:34Reported by GoogleType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1433 Views🌐 WEB

Keras Model.load_model allows arbitrary code execution via malicious .keras archives even in safe mode.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses keras-2.14.0-py3-none-any.whl which is vulnerable to CVE-2025-1550.	5 Jan 202606:15	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Watson NLP affects IBM Robotic Process Automation which may result in arbitrary code execution (CVE-2025-1550).	16 Jan 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Watson Studio in Cloud Pak for Data.	5 Dec 202508:46	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary Code Execution in Keras	19 Dec 202515:10	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: keras (CVE-2025-1550)	22 Jan 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-1550	2 Sep 202500:00	–	nessus
BDU FSTEC	The vulnerability of the Model.load_model function in the Keras library allows a hacker to execute arbitrary code.	13 Mar 202500:00	–	bdu_fstec
CBLMariner	CVE-2025-1550 affecting package keras for versions less than 3.3.3-2	18 Mar 202521:13	–	cbl_mariner
Chainguard	CVE-2025-1550 vulnerabilities	14 Mar 202516:12	–	cgr
Circl	CVE-2025-1550	11 Mar 202508:38	–	circl

NVD

Vulners

Node

keras kerasRange3.0.0–3.8.0

[
  {
    "collectionURL": "https://pypi.org/project/keras",
    "defaultStatus": "unaffected",
    "product": "Keras",
    "repo": "https://github.com/keras-team/keras",
    "vendor": "Google",
    "versions": [
      {
        "lessThan": "3.8.0",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "python"
      }
    ]
  }
]

Source	Link
github	www.github.com/keras-team/keras/pull/20751
towerofhanoi	www.towerofhanoi.it/writeups/cve-2025-1550/

Parameter	Position	Path	Description	CWE
config.json	path	malicious_model.keras	Insecure deserialization in Keras model loading via load_model using a crafted .keras file containing a malicious Lambda layer that deserializes a function from config.json to execute arbitrary commands.	CWE-94
model.weights.h5	path	malicious_model.keras	Insecure deserialization in Keras model loading via load_model using a crafted .keras file containing a malicious Lambda layer that deserializes a function from config.json to execute arbitrary commands.	CWE-94

17 Jun 2026 08:39Current

7.6High risk

Vulners AI Score7.6

CVSS 3.19.8

CVSS 47.3

EPSS0.02803

SSVC

CWE-94