GHSA-77wq-646f-jrm2
Duplicate Advisory: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-913 Improper Control of Dynamically-Managed Code Resources
- Fix
3.11.3- Upgrade keras to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-36rr-ww3j-vrjv. This link is maintained to preserve external references.
Original Description
The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.
One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.
This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.
Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| keras | >= 3.0.0, < 3.11.3 |
3.11.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
keras PyPI → 3.11.3
- pip
pip install --upgrade "keras>=3.11.3"- poetry
poetry add "keras>=3.11.3"- uv
uv add "keras>=3.11.3"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Local
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- High
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- High
- Exploit maturity
- Not defined
- Scope
- X
Weakness
CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
How to prevent it
- Implementation: For any externally-influenced input, check the input against an allowlist of acceptable values.
- Implementation, Architecture and Design: Refactor the code so that it does not need to be dynamically managed.
References
Advisories
Packages
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-74m6-m3xx-3vmj Keras model loading is vulnerable to denial of service through HDF5 shape bombs | Medium | Also affects keras |
| GHSA-m8wh-29wm-52mv Keras: HDF5 links can disclose local file contents | Medium | Also affects keras |
| GHSA-v2w2-w228-c444 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data | High | Also affects keras |
| GHSA-58hv-7753-xmfq Keras: tar extraction permits symlink-based path traversal | Medium | Also affects keras |
| GHSA-5gwj-m78q-7pq3 Keras: Lambda deserialization can bypass safe mode and execute code | Critical | Also affects keras |
| GHSA-26c4-7vv6-867j Keras: HDF5 virtual datasets can disclose local files | Medium | Also affects keras |
| GHSA-gh82-f9x8-5frx Keras: DiskIOStore permits path traversal through crafted layer names | Medium | Also affects keras |
| GHSA-hqp4-2352-xf5r Keras archive extraction utilities allow path traversal and arbitrary file writes | High | Also affects keras |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor