p PatchFirst

CVE-2025-49655

CVE-2025-49655

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.

CVSS 9.8 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • keras

    Versions
    • ≥ 3.11.0, < 3.11.3: Affected (semver)

    Update to 3.11.3

  • keras Debian:11

    Versions
    • 2.3.1+dfsg-3
    • 2.3.1+dfsg2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keras PyPI

    Versions
    • 3.11.0
    • 3.11.1
    • 3.11.2
    Affected ranges
    • ECOSYSTEM: ≥ 3.11.0, < 3.11.3

    Update to 3.11.3

  • keras Ubuntu:18.04:LTS

    Versions
    • 1.0.7-2
    • 2.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • keras Ubuntu:20.04:LTS

    Versions
    • 2.2.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →