CVE-2025-8747: Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-11 · updated 2026-06-17
Weakness: CWE-502

Description

A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.

Affected products

keras-team/keras: from 3.0.0 through 3.10.0

References

https://github.com/keras-team/keras/pull/21429
https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability/
https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability/

Get alerted when CVE-2025-8747 or the next vulnerability affects your stack