CVE-2025-8747
Fixed in a distro release EPSS <1%CVSS 8.6
A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.
Products: Google Keras
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keras | 3.11.0 |
| PyPI | keras | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tensorflow-cpu-jupyter | 2.19.0-r7 |
| Chainguard | tensorflow-gpu-jupyter | 2.19.0-r6 |
| Ubuntu 18.04 LTS | keras | no fix |
| Ubuntu 20.04 LTS | keras | no fix |