Database/AI/ML frameworks & serving
Keras (`Model.load_model`): Arbitrary code execution from a crafted `.keras` archive even with `safe_mode=True`
Impact
Arbitrary code execution from a crafted .keras archive even with safe_mode=True
Who can reach it
Customer-supplied Keras model file
What to do
Upgrade Keras in base images; no host-level patch. The safe-mode flag is not a security boundary
Fleet impact
How widespread
Very common - Keras 3.0.0-3.8.0 ships in most TF/Keras training images
Cost to remediate
**Image rebuild** across the fleet to Keras 3.9.0+; no host restart, but every image and every cached model must be re-vetted
Why it hits the whole fleet
Model.load_model executes arbitrary Python from a crafted .keras config *even with safe_mode=True*, so any model artifact pulled from a hub or a customer bucket is RCE on the loading GPU node
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.