AZL-58360 CVE-2025-1550 affecting package keras for versions less than 3.3.3-2

🗓️ 11 Mar 2025 09:15:25Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Keras Model.load_model allows code execution via a crafted .keras archive even with safe_mode, for versions below 3.3.3-2.

Reporter	Title	Published	Views	Family All 40
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses keras-2.14.0-py3-none-any.whl which is vulnerable to CVE-2025-1550.	5 Jan 202606:15	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Watson NLP affects IBM Robotic Process Automation which may result in arbitrary code execution (CVE-2025-1550).	16 Jan 202614:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Watson Studio in Cloud Pak for Data.	5 Dec 202508:46	–	ibm
IBM Security Bulletins	Security Bulletin: Arbitrary Code Execution in Keras	19 Dec 202515:10	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: keras (CVE-2025-1550)	22 Jan 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-1550	2 Sep 202500:00	–	nessus
CBLMariner	CVE-2025-1550 affecting package keras for versions less than 3.3.3-2	18 Mar 202521:13	–	cbl_mariner
Chainguard	CVE-2025-1550 vulnerabilities	14 Mar 202516:12	–	cgr
Circl	CVE-2025-1550	11 Mar 202508:38	–	circl
CNNVD	Keras 代码注入漏洞	11 Mar 202500:00	–	cnnvd