CVE-2025-8747
📋 TL;DR
A safe mode bypass vulnerability in Keras allows attackers to execute arbitrary code by tricking users into loading malicious .keras model archives. This affects all users of Keras versions 3.0.0 through 3.10.0 who load untrusted model files.
💻 Affected Systems
- Keras
📦 What is this software?
Keras by Keras
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Remote code execution in the context of the user loading the model, allowing attackers to steal credentials, install malware, or pivot to other systems.
If Mitigated
No impact if safe_mode is properly enforced or only trusted models are loaded.
🎯 Exploit Status
Exploitation requires user interaction to load a malicious model file. Public proof-of-concept exists in GitHub PR.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.10.1 and later
Vendor Advisory: https://github.com/keras-team/keras/pull/21429
Restart Required: No
Instructions:
1. Update Keras to version 3.10.1 or later using pip: pip install --upgrade keras>=3.10.1
2. Verify the update with: python -c "import keras; print(keras.__version__)"
🔧 Temporary Workarounds
Enable safe_mode enforcement
allForce safe_mode=True when loading models to prevent deserialization of untrusted data
Model.load_model('model.keras', safe_mode=True)
Restrict model loading
allOnly load models from trusted sources and validate file integrity before loading
🧯 If You Can't Patch
- Implement strict input validation for all model loading operations
- Isolate Keras applications in containers or sandboxes to limit blast radius
🔍 How to Verify
Check if Vulnerable:
Check Keras version: python -c "import keras; print(keras.__version__)" - if version is between 3.0.0 and 3.10.0 inclusive, system is vulnerable.Check Version:
python -c "import keras; print(keras.__version__)"Verify Fix Applied:
Verify Keras version is 3.10.1 or later: python -c "import keras; print(keras.__version__)"📡 Detection & Monitoring
Log Indicators:
- Unexpected .keras file loads from untrusted sources
- Model.load_model() calls with suspicious file paths
Network Indicators:
- Downloads of .keras files from untrusted external sources
SIEM Query:
source="application.log" AND "Model.load_model" AND ("safe_mode=False" OR NOT "safe_mode=True")