Critical Keras 3 RCE Flaw Allows Code Execution on Model Load

EXECUTIVE SUMMARY:

A critical remote code execution vulnerability CVE-2025-49655, CVSS 9.8 was identified in Keras 3 affecting the Torch backend in versions 3.11.0 through 3.11.2. The flaw resides in the TorchModuleWrapper.from_config() method, which invokes torch.load(..., weights_only=False), leading to unsafe use of Python’s pickle deserialization. This allows a specially crafted .keras model file or configuration to execute arbitrary system commands when loaded — even if safe_mode=True. The issue poses a significant risk to machine learning supply chains, as attackers can exploit it by embedding malicious payloads in shared or downloaded models.