Database/AI/ML frameworks & serving
Keras (`Model.load_model`): Arbitrary code execution from a crafted `.keras` archive even with `safe_mode=True`
Impact
Arbitrary code execution from a crafted .keras archive even with safe_mode=True
Who can reach it
Customer-supplied Keras model file
What to do
Upgrade Keras in base images; no host-level patch. The safe-mode flag is not a security boundary
Fleet impact
How widespread
Very common - Keras 3.0.0-3.8.0 ships in most TF/Keras training images
Cost to remediate
**Image rebuild** across the fleet to Keras 3.9.0+; no host restart, but every image and every cached model must be re-vetted
Why it hits the whole fleet
Model.load_model executes arbitrary Python from a crafted .keras config *even with safe_mode=True*, so any model artifact pulled from a hub or a customer bucket is RCE on the loading GPU node
References
Related entries
- LlamaIndex (vector store integrations): SQL injection across multiple vector store integrationsCVE-2025-1793 · LlamaIndex (vector store integrations)Critical
- picklescan (model scanner): Scanner fails to detect malicious pickles when ZIP flag bits are flippedCVE-2025-1945 · picklescan (model scanner)Critical
- NVIDIA Triton: Stack buffer overflowCVE-2025-23310 · NVIDIA TritonCritical
- NVIDIA Triton: Stack overflow via crafted requestCVE-2025-23311 · NVIDIA TritonCritical
- NVIDIA Triton Inference Server (Python backend): Attacker-controlled input in the Python backendCVE-2025-23316 · NVIDIA Triton Inference Server (Python backend)Critical
- BentoML: RCE via insecure deserializationCVE-2025-27520 · BentoMLCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.