Introduction
An attacker who crafts a Keras model file to exploit deserialization flaws in TorchModuleWrapper can run arbitrary code on any system that loads it, even when safe mode is enabled. The vulnerability affects many machine learning workflows, including automated pipelines and collaborative research environments where model files are routinely shared and loaded from external sources.
About Keras: Keras is an open-source deep learning framework maintained by Google. It is a high-level API for building and training neural networks, with TensorFlow, PyTorch, and JAX as computational backends. Keras has over 62,000 GitHub stars and is used in over 300,000 projects across academic and industry AI development.
Technical information
CVE-2025-49655 is a deserialization vulnerability in Keras versions 3.11.0 up to but not including 3.11.3. The flaw is in the model loading mechanism that deserializes TorchModuleWrapper objects from .keras model archives.
An attacker can craft a config.json inside a .keras archive that defines a TorchModuleWrapper layer with malicious initialization parameters. During deserialization, Keras instantiates both the wrapper and the underlying PyTorch module. In affected versions, the safe mode checks do not sufficiently validate the parameters passed to TorchModuleWrapper, so the attacker can specify values that execute arbitrary Python code during model loading.
The root cause is insufficient validation of deserialized parameters for TorchModuleWrapper. Loading either a local or a remote model file can trigger the vulnerability, and no user interaction is needed beyond loading the model. No public code snippets are available for this vulnerability.
Affected systems and versions
- Keras framework versions 3.11.0, 3.11.1, and 3.11.2 are affected
- All configurations are vulnerable if they load model files containing TorchModuleWrapper layers from untrusted sources
- The vulnerability is present whether or not safe mode is enabled
Vendor security history
Keras has had multiple deserialization vulnerabilities in recent years, including:
- CVE-2024-3660: Arbitrary code execution via Lambda layers
- CVE-2025-1550: Safe mode bypass through configuration manipulation
- CVE-2025-8747: Code execution via internal function misuse
- CVE-2025-9906: Safe mode bypass through configuration ordering
The vendor has responded with incremental improvements to safe mode and rapid patch releases, but the repeated bypasses point to ongoing architectural problems in secure model deserialization.
