CVE-2025-49655 Keras framework vulnerable to deserialization of untrusted data
Attackers can execute arbitrary code by tricking users into loading malicious Keras files, bypassing safe mode restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49655?
CVE-2025-49655 is a critical unsafe deserialization vulnerability in Keras, published on 17 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being enabled. The vulnerability can be triggered through both local and remote files.
Weakness: CWE-502
Which versions are affected by CVE-2025-49655?
3 open source packages ship an affected version, including keras.
| Package | Affected | Fixed in |
|---|---|---|
keras PyPI | From 3.11.0 | 3.11.3 |
keras PyPI | From 3.11.0 | 3.11.3 |
keras PyPI | From 3.11.0 | 3.11.3 |
How do I fix CVE-2025-49655?
Upgrade keras to 3.11.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-49655 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49655 exists.
Sources
Also known as DEBIAN-CVE-2025-49655, GHSA-cvhh-q5g5-qprp, PYSEC-2026-368, UBUNTU-CVE-2025-49655.