Live › vulnerability › CVE-2025-49655
Go to dashboardKeras versions 3.11.0 up to 3.11.3 deserialize a TorchModuleWrapper class from a model file, so a malicious .keras file can run arbitrary code when loaded. The code runs even with safe mode enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:22 UTC, 0h before NVD. All times on this page are UTC.
Any application that loads Keras model files from a path or URL it does not fully control, such as user uploads, model hubs or shared artifacts. Systems that only load models they built and stored themselves are much less exposed. Teams not using Keras 3.11.x can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| keras | pypi | >= 3.11.0, < 3.11.3 | 3.11.3 |
pip show keras and look for a version from 3.11.0 up to but not including 3.11.3keras pins in that range3.11.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
This page as .md · .json · in your agent: get_signal("CVE-2025-49655")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.