Skip to main content

Improper Control of Dynamically-Managed Code Resources

CVE-2025-9905

High
7.3/10

Summary

The Keras "Model.load_model" method can be exploited to achieve Arbitrary Code Execution, even with "safe_mode=True". One can create a specially crafted ".h5"/".hdf5model" archive that, when loaded via "Model.load_model", will trigger arbitrary code to be executed. This is achieved by crafting a special ".h5archive" file that uses the Lambdalayer feature of Keras, which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the "safe_mode=True" option is not honored when reading .h5archives.This vulnerability affects 3.0.0 through 3.11.2. Note that the .h5/.hdf5format is a legacy format supported by Keras 3 for backwards compatibility

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • HIGH

CWE-913 - Improper Control of Dynamically-Managed Code Resources

The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References

Advisory Timeline

  • Published