Critical Keras 3 RCE Flaw (CVE-2025-49655, CVSS 9.8) Allows Code Execution on Model Load

Researchers at HiddenLayer have disclosed a critical arbitrary code execution vulnerability in the Keras 3 deep learning framework, affecting the Torch backend of versions 3.11.0 through 3.11.2 (CVE-2025-49655, CVSS 9.8). According to the HiddenLayer report, the flaw arises from insecure deserialization in the TorchModuleWrapper class, where torch[.]load() is used with weights_only set to False, causing Python’s pickle to deserialise objects and potentially run arbitrary code during model loading.

The exploit can be triggered by loading a malicious model file, even when Keras’ safe mode is enabled, by embedding a crafted payload into the model’s configuration. The proof-of-concept shows a base64-encoded payload object invoking os[.]system() during deserialization, enabling full local code execution on the machine loading the model.

The advisory notes that weaponised Keras model files (.keras) could be used to deliver hidden payloads, underscoring a significant risk to ML supply chains across development and production environments.