Data Exposure Vulnerability Found in Deep Learning Tool Keras

SecurityWeek reports a vulnerability in the open source Keras library, tracked as CVE-2025-12058, which could allow arbitrary local file loading and server-side request forgery (SSRF) attacks. The flaw arises because the library’s StringLookup and IndexLookup preprocessing layers could use file paths or URLs as inputs to define vocabularies, and deserialization could read those contents into the model state.

According to Zscaler, this behaviour bypasses safe deserialization, enabling attackers to read arbitrary local files, exfiltrate information through vocabularies, and conduct SSRF attacks, even when security features like safe_mode are enabled. In real-world scenarios, attackers could upload malicious Keras models to public repositories with crafted vocabulary parameters targeting SSH keys, with the victim’s keys read into the model during load.

The vulnerability has a CVSS score of 5.9 and was resolved in Keras version 3.11.4 by embedding vocabulary files directly into the Keras archive and restricting loading of arbitrary vocabulary files when safe_mode is enabled.