{"data":{"id":"8f4ae7e5-d40b-4b45-8b16-30260414d108","title":"CVE-2025-9905: The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One…","summary":"CVE-2025-9905 is a flaw in the Keras Model.load_model method that allows arbitrary code execution even when safe_mode=True is set. A specially crafted .h5/.hdf5 model archive uses a Lambda layer to embed pickled Python code, and the safe_mode=True option is not honored when reading .h5 archives. The .h5/.hdf5 format is a legacy format that Keras 3 supports for backwards compatibility.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9905","publishedAt":"2025-09-19T13:15:36.033Z","cveId":"CVE-2025-9905","cweIds":["CWE-913"],"cvssScore":"7.3","cvssSeverity":"high","severity":"high","attackType":["model_poisoning","supply_chain"],"issueType":"vulnerability","affectedPackages":["keras@>= 3.0.0, < 3.11.3 (fixed: 3.11.3)"],"affectedPackageNames":["keras"],"affectedPackageRefs":["pypi:keras"],"affectedVendors":["Google"],"affectedVendorsRaw":["Keras"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Keras Model.load_model arbitrary code execution through crafted .h5 archives","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00221,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-36rr-ww3j-vrjv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:40.393Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-21T22:08:55.858Z","daysToFix":-29,"fixCheckedAt":"2026-10-29T21:43:41.767Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"keras","fixedVersion":"3.11.3","matchedVersion":"3.11.3","fixReleasedAt":"2025-08-21T22:08:55.858Z","daysToFix":-29,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:41.617Z"}]}}