CVE-2025-8747: Keras Vulnerable to Bypass of Safe Mode Leading to Arbitrary File Overwrite
Summary
CVE-2025-8747: Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality. Affects keras versions >= 3.0.0, < 3.11.0. Fixed in 3.11.0. How to fix ↓
Also tracked for
- keras · Debian:11
The same CVE-2025-8747 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keras is an open-source deep learning framework that provides a user-friendly API for building and training machine learning models. It is widely used for its ease of use and flexibility, allowing developers to create complex neural networks with minimal code. However, Keras has a vulnerability that can be exploited when loading untrusted models, particularly in versions prior to 3.11.0, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from a bypass of the mitigation introduced for CVE-2025-1550, where an untrusted Keras v3 model can be loaded even with 'safe_mode' enabled. This is possible by crafting malicious arguments to built-in Keras modules, allowing for unsafe deserialization. The impact includes arbitrary file overwrite, which can lead to arbitrary code execution, especially if an attacker can manipulate files on the victim's machine. The vulnerability exploits the 'keras.utils.get_file' function to download files to an attacker-controlled location, bypassing the safe_mode restrictions.
How To Fix
Latest published version: 3.15.1 as of 22 Oct 2026
pip install --upgrade "keras==3.15.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.0
This is the first release that contains the fix.
pip install --upgrade "keras==3.11.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid loading untrusted Keras models, especially if they are from unknown sources. Additionally, consider implementing stricter controls on the models you load and avoid using the 'safe_mode' flag if you cannot guarantee the trustworthiness of the model.
Conclusion
CVE-2025-8747 is a significant vulnerability in Keras that can lead to severe security risks if untrusted models are loaded. It is crucial to update to the latest version of Keras and implement best practices for model management to mitigate these risks.
See every vulnerability recorded for keras →
FAQ
CVE-2025-8747 is a vulnerability in Keras that allows for the bypass of safe mode when loading untrusted models, potentially leading to arbitrary file overwrite and code execution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock.
If you cannot update Keras immediately, avoid loading untrusted models and consider implementing additional security measures to mitigate risks.
The consequences include arbitrary file overwrite, which can lead to unauthorized access and control over the victim's machine, potentially allowing attackers to execute malicious code.
To prevent similar vulnerabilities, ensure that you regularly update your dependencies, audit your code for security issues, and implement strict controls on the models you load.
References
Related vulnerabilities
Recent vulnerabilities recorded for keras.
