CriticalPublic exploit

Remote Code Execution in Keras TorchModuleWrapper Deserialization

IdentifiersCVE-2025-49655CWE-502· Deserialization of Untrusted Data

CVE-2025-49655 is a critical deserialization vulnerability in Keras affecting versions 3.11.0 through 3.11.2 (fixed in 3.11.3). The flaw exists in the model loading/deserialization path for .keras archives, specifically when deserializing TorchModuleWrapper objects. A malicious actor can craft a .keras model archive with a manipulated config.json that defines a TorchModuleWrapper layer with malicious initialization parameters. During model load, Keras instantiates the TorchModuleWrapper object and the underlying PyTorch module without sufficient validation of deserialized parameters. This unsafe deserialization path remains reachable even when Keras safe mode is enabled, allowing arbitrary code execution from both locally supplied and remotely obtained model files.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in arbitrary code execution in the security context of the process loading the malicious Keras model. This can lead to full compromise of the affected environment, including theft or modification of model artifacts and data, tampering with training or inference workflows, installation of persistence mechanisms, lateral movement from ML pipelines, and disruption of availability. Because the issue can be triggered by loading untrusted model files in automated or collaborative workflows, it poses particular risk to shared research environments and CI/CD or MLOps pipelines.

Mitigation

If you can’t patch tonight, do this now.

Do not load .keras model files from untrusted or unauthenticated sources. Restrict model import paths to trusted repositories, enforce provenance and integrity verification for model artifacts, and isolate model-loading workflows in sandboxed or low-privilege environments. Where possible, require manual or automated inspection of externally sourced model archives before loading, especially those containing TorchModuleWrapper-related content. Additional defensive measures include network segmentation for ML workers and minimizing privileges of processes that deserialize models.

Remediation

Patch, then assume compromise.

Upgrade Keras to version 3.11.3 or later, as the issue is reported fixed there and referenced by Keras GitHub PR #21575. Review all systems and pipelines that load .keras model archives and ensure vulnerable versions 3.11.0, 3.11.1, and 3.11.2 are removed or upgraded. If model ingestion is part of an automated workflow, update dependency pinning and rebuild affected environments to ensure the patched package is deployed consistently.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

security online infoNews

Oct 20, 2025

Critical Keras 3 RCE Flaw (CVE-2025-49655, CVSS 9.8) Allows Code Execution on Model Load

A critical remote code execution vulnerability in Keras 3 that allows code execution when a model is loaded.

cvefeed high severityNews

Oct 17, 2025

CVE-2025-49655 - Keras TorchModuleWrapper Deserialization Vulnerability

A critical deserialization-of-untrusted-data issue in Keras (3.11.0 to <3.11.3) where loading a malicious Keras file containing a TorchModuleWrapper can lead to arbitrary code execution even when safe mode is enabled; triggerable via local or remote files.

zeropath blogNews

Oct 17, 2025

Keras CVE-2025-49655: Brief Summary of Critical Deserialization Vulnerability in TorchModuleWrapper - ZeroPath Blog | ZeroPath

A deserialization vulnerability in Keras that allows arbitrary code execution during loading of malicious .keras model files via TorchModuleWrapper, even when safe mode is enabled.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2